CVE-2026-10134 is a critical code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.3. It allows unauthenticated attackers to execute arbitrary code by modifying the public flow's tool_code, which causes normal API build calls to re-execute attacker-supplied code. The vulnerability enables attackers to read all secrets available to the Langflow process, manipulate all stored data including flows, conversations, messages, file uploads, and saved components, connect to internal services, abuse cloud metadata endpoints, and move laterally to other tenants on the same Langflow instance. Persistence is achieved through modification of the public flow's tool_code, making this a severe and comprehensive compromise of the affected system.

Successful exploitation results in full compromise of the Langflow OSS instance, including disclosure of all secrets accessible to the process, full read and write access to all stored data, unauthorized access to internal services, abuse of cloud metadata endpoints, lateral movement across tenants, and persistent arbitrary code execution on all subsequent API build calls. The vulnerability affects confidentiality, integrity, and availability with maximum impact.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to Langflow OSS instances, monitor for suspicious activity, and consider isolating affected deployments to prevent lateral movement and abuse of internal services.