CVE-2026-6543CWE-94

Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint

High · published April 30, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00712 · 53.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-04-30T21:11Z
EPSS history
Timeline
  • 30 APR 21:11Z
    Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint
    cvelistv5