CVE-2026-10134: Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Synopsis

An unauthenticated remote code execution vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.9.3, affecting the PythonCodeStructuredTool component in publicly accessible flows. An attacker reachable over the network with no credentials whatsoever can send a crafted request to a public flow endpoint and execute arbitrary Python code inside the Langflow server process. Successful exploitation grants full read and write access to all flows, secrets, and database contents, plus the ability to establish persistent code execution for every subsequent user who triggers a build. No upstream fix has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Langflow service via HTTP/HTTPS to trigger the PythonCodeStructuredTool execution path.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is reachable through public flow endpoints without any login or token.

• Victim interactionNot required

  No user action is needed to trigger the initial exploit; the attacker sends a direct request to the build API without any victim involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or environmental prerequisite stands between the attacker and code execution.

Blast Radius

• Reads every secret (API keys, credentials, environment variables) accessible to the Langflow server process.
• Reads and overwrites all flows, conversations, messages, file uploads, and saved components in the Langflow database.
• Connects to internal services and cloud metadata endpoints (such as the AWS instance metadata service), enabling lateral movement to other tenants on the same Langflow instance.
• Establishes persistence by rewriting a public flow's tool_code so that every subsequent user-triggered build re-executes attacker-controlled Python code server-side.