CVE Intelligence
Analysis AI-assisted

CVE-2026-7871: IBM Langflow OSS Deserialization Flaw Enabling Code Execution via Redis Access

IBM disclosed CVE-2026-7871, a critical deserialization of untrusted data flaw (CWE-502) in Langflow OSS versions from 1.0.0 through 1.10.0. According to the record, a user with Redis access can execute arbitrary code with full application privileges. The CNA-provided CVSS 3.1 base score is 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM has published a vendor advisory for Langflow OSS covering versions from 1.0.0 through 1.10.0. The record describes a flaw that lets a user with access to Redis execute arbitrary code with the application's full privileges. The weakness is classified as CWE-502, Deserialization of Untrusted Data. See the IBM advisory and the NVD entry.

Impact

  • Arbitrary code execution with full application privileges, as stated in the record.
  • Potential compromise of all application secrets and data.
  • Loss of system integrity, as described in the record.
  • The CNA assigned a CVSS 3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products and versions

  • Product listed in the record: Langflow Langflow (Langflow OSS).
  • Affected range: 1.0.0 through 1.10.0 inclusive.
  • The record does not list any fixed version. The absence of a listed fix does not mean no fix exists; consult the IBM advisory for remediation details.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE, so active exploitation is not confirmed by the KEV data. No confirmed exploitation appears in the sources consulted. The EPSS probability reported in the record is 0.00695 (percentile 0.51708).

Remediation and mitigation

  • Review the IBM advisory and identify the corrective action for your Langflow OSS deployment; the record does not specify a fixed version.
  • Inventory all Langflow OSS instances within the affected range and prioritize those that are reachable by untrusted or lower-privileged users.
  • Restrict and monitor access to Redis, since the record ties exploitation to Redis access. Apply least privilege, network segmentation and authentication to Redis.
  • Rotate secrets stored in the application if there is any indication of unauthorized access, given the stated impact on all secrets.

Detection guidance

  • Audit access logs for Redis and review who can write or modify data that the application later reads.
  • Look for unexpected child processes or unusual outbound activity originating from Langflow processes.
  • Monitor for unexpected changes to application configuration, stored data or secrets.

Limitations of the available information

  • The record does not describe the exact vulnerable code path, the Redis data flow involved, or required preconditions beyond Redis access.
  • No fixed version, patch identifier or workaround is listed in the record; these are unknown from the data provided.
  • The record contains no proof-of-concept details, and this analysis does not provide exploitation steps.
  • Only the IBM advisory and NVD entry were consulted.

Frequently asked questions

What is CVE-2026-7871?

It is a critical deserialization of untrusted data flaw (CWE-502) in IBM Langflow OSS versions 1.0.0 through 1.10.0, according to the record. The CNA assigned a CVSS 3.1 base score of 9.8.

Is this CVE known to be actively exploited?

No. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.