CVE-2026-8182

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
IBM	Langflow OSS	>= 1.0.0, <= 1.10.3

References

https://www.ibm.com/support/pages/node/7282646Vendor Advisory

Timeline

Published: Aug 5, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-818205.1Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * CVE-2026-818218.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive informati CVE-2026-818228.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ ap CVE-2026-818235.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resu CVE-2026-818244.7The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was s CVE-2026-818257.2The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all CVE-2026-818269.1Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an atta CVE-2026-818276.9Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForm CVE-2026-818288.1Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user CVE-2026-818295.3A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load CVE-2026-81837.7IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 thr CVE-2026-818305.6The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directo