What is CVE-2026-8635?

CVE-2026-8635 is a critical-severity vulnerability in Ibm Langflow Oss, classified under Code Injection. CVSS score: 9.9/10. Published 2026-07-17.

How severe is CVE-2026-8635?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Ibm Langflow Oss

CVE-2026-8635

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permiss…

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Ibm Langflow Oss — versions 1.0.0

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-8635?: CVE-2026-8635 is a critical-severity vulnerability in Ibm Langflow Oss, classified under Code Injection. CVSS score: 9.9/10. Published 2026-07-17.
How severe is CVE-2026-8635?: Critical severity. CVSS v3 base score is 9.9 out of 10.