CVE-2026-7873

Code Injection Vulnerability in Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

Affected

IBM · Langflow OSS

CVSS v3.1 IBM

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

1.07% chance of exploitation in the next 30 days, 64th percentile

Published

2026-06-30

Updated

2026-07-01

Proof-of-concept exploits (1)

• rmhowe425/POC-CVE-2026-78733★ · 2026-09-05

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/langflow_auth_rce_cve…

Security advisories

• https://www.ibm.com/support/pages/node/7278441

References

• CVE Record
• NVD entry

Related

• CVE-2025-11201
• CVE-2025-68613
• CVE-2026-0768
• CVE-2026-0769
• CVE-2026-10134
• CVE-2026-18729