IBM Langflow OSS executes unintended code during Agentic Assistant validation

# IBM Langflow OSS executes unintended code during Agentic Assistant validation

https://gcdradar.vercel.app/incidents/ibm-langflow-oss-executes-unintended-code-during-agentic-ass · AIR-2026-1243 · closed 2026-08-05

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-08-05
- AI role: Attack on AI
- Products: Langflow OSS
- CVE ids: CVE-2026-9196
- CVSS: 8.1

## Summary

IBM Langflow OSS improperly handles LLM-generated components by executing model-generated Python code in the backend prior to user approval. An attacker can exploit this to trigger side effects such as outbound network access, file system interaction, or data exfiltration.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-08-05: CVE-2026-9196: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant… (https://nvd.nist.gov/vuln/detail/CVE-2026-9196)

## Sources

- 2026-08-05 NVD: CVE-2026-9196: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant… https://nvd.nist.gov/vuln/detail/CVE-2026-9196

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.