CVE-2026-9135

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.

• CWE-94

• https://www.ibm.com/support/pages/node/7278920Vendor Advisory

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9128A code execution security issue exists within Studio 5000 Lo…7.3
• CVE-2026-9129A path traversal vulnerability exists in the Altium Enterpri…9.4
• CVE-2026-9130IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorizati…7.1
• CVE-2026-9132A missing authorization vulnerability was identified in GitH…6.5
• CVE-2026-9133Active debug code exists in the ARN resolver of amazon-mq ra…8.3
• CVE-2026-9134The FooGallery plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-9136A vulnerability was identified in the ShadowAttribute propos…6.5
• CVE-2026-9137The CSP report endpoint in MISP intended to limit logged CSP…7.5
• CVE-2026-9139Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9140A denial-of-service security issue exists in the 1719-AENTR.…8.7
• CVE-2026-9141Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9142There is an insecure default credentials vulnerability in NI…9.3