CVE-2026-17624: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17624?
CVE-2026-17624 has a risk rating of 71, indicating a high severity level.
What type of vulnerability is CVE-2026-17624?
CVE-2026-17624 is a remote code execution vulnerability caused by improper validation of module imports.
Who is affected by CVE-2026-17624?
CVE-2026-17624 affects users of IBM Langflow OSS that support module imports.
How do I fix CVE-2026-17624?
To fix CVE-2026-17624, ensure to implement proper validation measures for module imports in your Langflow OSS setup.
Can CVE-2026-17624 be exploited remotely?
Yes, CVE-2026-17624 can be exploited remotely by authenticated attackers.