IBM Langflow OSS 1

CVE-2026-10134 is an unauthenticated remote code execution flaw in IBM Langflow OSS versions 1.0.0 through 1.9.3. The PythonCodeStructuredTool component executes attacker-controlled Python via exec(self.tool_code, globals(), local_namespace) at flow-build time. Two paths reach the sink: (A) an authenticated POST /api/v1/build/{flow_id}/flow with a session token, and (B) — the dangerous one — POST /api/v1/build_public_tmp/{flow_id}/flow, which accepts builds without any Authorization header once a flow is marked PUBLIC. The result: a single unauthenticated HTTP request yields code execution as the Langflow process user, in the container/host it runs on.

The vendor's CRITICAL / 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H is accurate and, if anything, understated by the base metrics. This is a near-identical repeat of the March 2026 Langflow story (CVE-2026-33017), which Sysdig observed being weaponized within 20 hours of disclosure, with ~7,000 exposed instances scanned. Langflow's target audience — data/ML teams standing up agentic RAG pipelines — routinely exposes it directly to the internet with default configs. No downgrade is warranted.

Why this verdict

• Zero prerequisites — path (B) requires no session token, no user interaction, no local access. Vendor CVSS AV:N/AC:L/PR:N/UI:N is accurate.
• Role multiplier — agent orchestrator with mounted secrets: Langflow's deployment role IS the high-value role. Instances routinely hold LLM API keys, vector DB creds, cloud IAM credentials, and Kubernetes service-account tokens. Chain outcome = credential looting + lateral pivot; blast radius = tenant-scale minimum, cloud-account-scale realistically.
• Precedent: CVE-2026-33017 (March 2026) was the same product, same class of bug, exploited in 20 hours, KEV-listed, and ~7,000 instances were mass-scanned. Baseline population of exposed instances is not hypothetical.
• No friction floor: even if only 10% of installs mark a flow PUBLIC, the vendor default demo flows are frequently public, and path (A) still works against any authenticated attacker — a broad category on multi-tenant Langflow-as-a-service.
• No compensating vendor control: no built-in sandboxing on PythonCodeStructuredTool; the design intent of the component is to execute code, so a partial fix is impossible.

Why not higher?

Score is 9.6, not a raw 10.0, because path (B) requires at least one PUBLIC flow to exist on the target — a small but real filter. Hardened deployments with zero public flows require path (A), which adds an authenticated-user prerequisite. This is a rounding-error downgrade, not a real one.

Why not lower?

Downgrading to HIGH would require either meaningful auth requirements (there are none on path B), a narrow affected version range (there isn't — 1.0.0 through 1.9.3 is the entire modern product line), or evidence of low exposure (Shodan disagrees). The prior -33017 wave demonstrated all three of those excuses are wrong for this product class.

1. Take Langflow off the public internet immediately — Front it with an SSO reverse proxy (Cloudflare Access, Tailscale, Pomerium, oauth2-proxy) that enforces authentication BEFORE any request reaches Langflow. Do this within the noisgate CRITICAL 3-day mitigation SLA — realistically today.
2. Un-publish every PUBLIC flow — Query the flows table and set is_public=false for every row. This closes path (B) entirely and buys you the runway to patch cleanly.
3. Block /api/v1/build_public_tmp/ at the WAF/ingress — Add a deny rule on the exact path prefix at your reverse proxy or WAF (nginx location, HAProxy ACL, Cloudflare custom rule). This is a same-day mitigation independent of Langflow config.
4. Upgrade to Langflow 1.9.4+ — The actual remediation. Deploy within the noisgate CRITICAL 90-day remediation SLA, but treat this as a 7-day target given the -33017 precedent.
5. Rotate every secret Langflow could reach — Assume compromise. Rotate LLM API keys, vector DB creds, cloud IAM keys, and any Kubernetes service-account tokens mounted into the Langflow pod. Do this in parallel with the mitigation.
6. Hunt for post-exploitation IOCs — Grep webserver logs for POSTs to /api/v1/build_public_tmp/, look for python spawning sh, curl, wget, or outbound connections to known cryptomining pools, and check IMDS access anomalies. Preserve the pod filesystem before restart.

Run on the Langflow host or container (or an auditor workstation with HTTP access to the target). Invoke as ./check-cve-2026-10134.sh https://langflow.internal.example.com. Requires only curl and jq; no privileges needed beyond network reach to the target.

#!/usr/bin/env bash
# noisgate check for CVE-2026-10134 — Langflow unauth RCE
# Usage: ./check-cve-2026-10134.sh <base_url>
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <langflow_base_url>" >&2
  exit 2
fi

# Strip trailing slash
TARGET="${TARGET%/}"

# 1. Fetch version banner
VER_JSON=$(curl -sk --max-time 10 "$TARGET/api/v1/version" 2>/dev/null || true)
VERSION=$(echo "$VER_JSON" | jq -r '.version // empty' 2>/dev/null)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not read /api/v1/version from $TARGET"
  exit 3
fi

echo "Detected Langflow version: $VERSION"

# 2. Version comparison — vulnerable if 1.0.0 <= v <= 1.9.3
vuln_range() {
  local v="$1"
  # Compare using sort -V
  local low="1.0.0" high="1.9.3"
  if [[ "$(printf '%s\n' "$low" "$v" | sort -V | head -n1)" == "$low" ]] && \
     [[ "$(printf '%s\n' "$v" "$high" | sort -V | tail -n1)" == "$high" ]]; then
    return 0
  fi
  return 1
}

# 3. Probe the vulnerable endpoint (safe probe — no exec payload)
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 10 \
  -X POST "$TARGET/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow" \
  -H 'Content-Type: application/json' -d '{}' 2>/dev/null || echo "000")

echo "build_public_tmp probe HTTP status: $HTTP_CODE"

if vuln_range "$VERSION"; then
  # Endpoint reachable if not 404/403/401
  if [[ "$HTTP_CODE" != "404" && "$HTTP_CODE" != "403" && "$HTTP_CODE" != "401" && "$HTTP_CODE" != "000" ]]; then
    echo "VULNERABLE: version $VERSION in affected range AND unauth endpoint reachable"
    exit 1
  else
    echo "VULNERABLE: version $VERSION in affected range (endpoint filtered upstream but code is present — patch anyway)"
    exit 1
  fi
fi

echo "PATCHED: version $VERSION is outside affected range 1.0.0-1.9.3"
exit 0

Sources

1. IBM Security Bulletin (node/7277559)
2. GHSA-vwmf-pq79-vjvx — Langflow unauth RCE advisory
3. BitNinja — CVE-2026-10134 alert
4. Sysdig TRT — CVE-2026-33017 weaponized in 20 hours (precedent)
5. The Hacker News — Langflow flaw triggers attacks in 20 hours
6. SecurityWeek — Langflow exploited hours after disclosure
7. VentureBeat — 7,000 Langflow servers under attack
8. SonicWall — Langflow AI code injection to RCE analysis