CVE-2026-10561: Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection

Synopsis

An unauthenticated remote code execution vulnerability affects IBM Langflow OSS versions 1.0.0 through 1.9.3, caused by improper isolation of the Python execution environment combined with an authentication bypass in the PythonREPLComponent. An attacker reachable over the network requires no credentials and no victim interaction to exploit this flaw. Successful exploitation gives the attacker arbitrary code execution on the host system, resulting in full compromise of confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network; an attacker must be able to reach the Langflow OSS service via HTTP or equivalent network path to deliver the payload.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the authentication bypass allows exploitation by any unauthenticated network caller.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user action; exploitation is fully server-side with no social-engineering step required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions, specific memory layout, or environmental configuration.

Blast Radius

• The attacker executes arbitrary Python code as the process user on the host system, gaining an interactive foothold equivalent to a shell.
• All data accessible to the Langflow process (environment variables, secrets, API keys, model configs) is readable by the attacker.
• The attacker can write, modify, or delete files and data on the host filesystem and any mounted volumes.
• The host service and any dependent services sharing the same runtime can be crashed or taken over, causing full availability loss.