CVE-2026-10561

CriticalCVSS 10.0/10Last modified Oct 25, 2026

Description

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
IBMLangflow OSS>= 1.0.0, <= 1.9.3

References

Timeline

Published
Jun 22, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1056104.7A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/bladCVE-2026-1056112.7A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-systCVE-2026-1056124.3PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is CVE-2026-1056135.8PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memorCVE-2026-1056144.7PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to proCVE-2026-1056154.3PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore reaCVE-2026-1056166.5PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visibleCVE-2026-1056176.5PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the uCVE-2026-1056186.5PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inherCVE-2026-1056196.5PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and laCVE-2026-105625.9An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL inputCVE-2026-1056206.5PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later
CVE-2026-10561: Critical severity, CVSS 10.0 | Vulnix