New Langflow RCE (CVE-2026-10134) Is a Perfect 10 — Patch Now and Rotate Your Keys

On June 30, 2026, a new flaw in Langflow, the popular open-source tool for building AI agents and workflows, was published as CVE-2026-10134 with a maximum CVSS score of 10.0. An unauthenticated attacker can run their own code on the server and, in the words of the NVD entry, "read every secret available to the Langflow process" and "read and modify every flow, conversation, message, file upload, and saved component" in its database. If you run Langflow anywhere it can be reached from the internet, treat this as a patch-now event: upgrade past the affected 1.0.0–1.9.3 range to the current release and rotate every credential the server could see.

What makes CVE-2026-10134 worth a closer look is not just the perfect 10 severity. It is the third critical remote-code-execution bug in Langflow this year, all rooted in the same design choice, and it lands at the exact moment thousands of teams are pushing AI agent builders into production without treating them like the internet-facing servers they are.

What is CVE-2026-10134?

CVE-2026-10134 is an unauthenticated server-side remote code execution (RCE) vulnerability in IBM Langflow OSS, affecting every release from 1.0.0 through 1.9.3. According to IBM's security bulletin, the flaw lives in the PythonCodeStructuredTool component, which passes a template field straight into Python's exec() at flow-build time. The tool code is attacker-controllable, so whatever a visitor supplies gets executed by the server process. There is no memory-corruption trickery here and no exploit chain to assemble: it is code injection by design, scored CVSS 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, no privileges, no user interaction, and a scope change that lets the compromise spread beyond the app itself. In plain terms, one HTTP request to the wrong endpoint hands over the box.

The "public flow" trap that removes the login wall

Langflow lets a user mark a flow as public so others can run it without an account. That convenience is what turns an authenticated bug into an unauthenticated one. Normally an attacker would need a valid session token to POST to /api/v1/build/{flow_id}/flow and trigger the vulnerable code. But once any legitimate user flips a flow to public with a PATCH setting {"access_type": "PUBLIC"}, a second endpoint — /api/v1/build_public_tmp/{flow_id}/flow — accepts build requests with no Authorization header at all. From that point, any anonymous visitor who reaches the instance can run the embedded Python. An attacker can also plant malicious code inside a public flow so it re-executes on every routine build, giving them persistence rather than a one-shot hit. The lesson for anyone self-hosting: a single "make this shareable" click can silently drop the front door.

Why this keeps happening to Langflow

CVE-2026-10134 is not an isolated slip. It is the latest entry in a pattern that has run through Langflow all year:

CVE	Disclosed	Severity	Root cause
CVE-2026-33017	March 2026	CVSS 9.8 (v3.1), unauth RCE	Unsanitized Python in the public flow-build endpoint
CVE-2026-5027	June 2026	CVSS 8.8, unauth RCE	Path traversal in the file-handling API
CVE-2026-10134	June 2026	CVSS 10.0, unauth RCE	exec() sink in PythonCodeStructuredTool

The recurring theme is a platform whose whole purpose is running user-authored code, exposing that capability over the network without a hard sandbox around it. When CVE-2026-33017 was disclosed in March, attackers built a working exploit from the advisory text and were hitting instances within 20 hours, before any public proof-of-concept existed. In June, the Cloud Security Alliance flagged CVE-2026-5027 as already under active exploitation. A tool with more than 145,000 GitHub stars and a design that executes arbitrary Python is exactly the kind of target that gets weaponized fast, so assume CVE-2026-10134 follows the same curve even where in-the-wild reports are still catching up.

What an attacker actually gets

The scary part of a secret-reading RCE is the blast radius beyond the app. Langflow processes typically hold the API keys for the LLM providers, vector databases, and third-party services the agents call, plus database connection strings and any credentials sitting in environment variables or a .env file. Once code runs as the Langflow process, all of that is readable. Past Langflow campaigns did precisely this: SentinelOne's write-up of CVE-2026-10134 and earlier Langflow incidents describe harvesting cloud provider credentials, database strings, and AI-service API keys, then pivoting to internal services and cloud metadata endpoints. A stolen OpenAI or Anthropic key means a runaway bill; a stolen cloud key can mean the rest of your account. The RCE is the door, but the credentials behind it are the real prize, which is why patching alone is not enough.

How to fix it

Treat CVE-2026-10134 as a two-part job: close the hole, then assume the keys already leaked.

• Upgrade now. Every release up to and including 1.9.3 is vulnerable, so move to the current Langflow release. IONIX's threat-center note on CVE-2026-10134 and IBM's bulletin both list upgrading as the primary remediation.
• Rotate everything the server could read. LLM and cloud API keys, database passwords, SSH keys, and any secret in the environment or .env should be rotated on any instance that was internet-reachable, patched or not.
• Get Langflow off the open internet. Put it behind a VPN or an authenticating reverse proxy. An AI flow builder has no business being directly exposed, and our own WaseerHost deployments keep this class of internal tooling on a private network by default.
• Audit your public flows. Review anything marked access_type: PUBLIC, especially flows using PythonCodeStructuredTool, and make "public" a deliberate, reviewed decision rather than a stray toggle.
• Watch for the aftermath. Check logs for unexpected calls to the public build endpoints and for outbound connections to unfamiliar hosts, which is the usual sign of credential exfiltration or a dropped miner.

The bigger picture for AI infrastructure

The through-line of 2026's Langflow bugs is that the AI agent stack is now a first-class attack surface, and it is being deployed with the security posture of a weekend hobby project. Frameworks like this exist to execute model-generated and user-authored code, which is inherently dangerous, yet they are frequently stood up on a public IP with a single admin account because a demo needed to be shareable. This is the same soft-underbelly story we covered in AI agent security and the prompt injection crisis, and it rhymes with the open-source supply-chain risk behind the Shai-Hulud npm worm. The fix is not to abandon these tools but to run them like production infrastructure: private by default, least-privilege credentials, secrets that rotate, and no experimental agent server sitting on the open web. If you handle patch cycles the way you would for a SharePoint zero-day, your AI stack deserves the same discipline.

Frequently asked questions

Which Langflow versions are affected by CVE-2026-10134? Every IBM Langflow OSS release from 1.0.0 through 1.9.3 is vulnerable, per the NVD entry. Anything in that range should be upgraded to the current release immediately, and credentials on exposed instances should be rotated regardless of the patch.

Is Langflow safe to use in production? Langflow can be run safely, but not naked on the public internet. Keep it behind a VPN or authenticating proxy, give it least-privilege API keys, avoid marking flows public unless you have reviewed their contents, and stay current on patches. The framework's job is to run code, so it needs the same isolation you would give any code-execution service.

Do I need to worry if my Langflow instance is internal-only? The risk drops sharply if the instance is not reachable from the internet, but it does not vanish. An attacker who lands inside your network, or a malicious public flow shared internally, can still reach the vulnerable endpoint. Patch internal instances too, and keep secrets scoped so a compromise of one tool does not hand over your whole cloud account.

What is the difference between CVE-2026-10134 and the earlier CVE-2026-33017? Both are unauthenticated RCE bugs in Langflow's public flow-building path. CVE-2026-33017 (March 2026, CVSS 9.8) came from unsanitized Python in the public build endpoint and was not fully fixed until Langflow 1.9.0 — releases 1.8.1 and 1.8.2 both stayed exploitable. CVE-2026-10134 (June 2026, CVSS 10.0) is a separate exec() sink in the PythonCodeStructuredTool component affecting versions up to 1.9.3. They are different flaws with the same underlying design problem.

Sources

• NVD — CVE-2026-10134 Detail: official CVSS 10.0 record, affected versions 1.0.0–1.9.3, and impact description (published June 30, 2026).
• IBM — Security Bulletin: Unauthenticated RCE via PythonCodeStructuredTool in Public Flows: vendor advisory identifying the vulnerable component and remediation.
• SentinelOne — CVE-2026-10134: Langflow RCE Vulnerability: impact, affected versions, and mitigation summary.
• IONIX — CVE-2026-10134 Unauthenticated RCE in IBM Langflow: threat-center analysis and remediation guidance.
• SecurityWeek — Critical Langflow Vulnerability Exploited Hours After Public Disclosure: the March CVE-2026-33017 case, weaponized within 20 hours.
• Cloud Security Alliance — Langflow CVE-2026-5027 Active Exploitation: the June path-traversal RCE confirmed under active attack.