CVE-2026-17624 is a code injection vulnerability (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.10.3. The vulnerability arises from improper validation of module imports, which can be exploited by a remote attacker with authentication to execute arbitrary code. The CVSS 3.1 base score is 8.5, reflecting high impact on confidentiality, integrity, and availability. The vendor has not provided an official fix or remediation guidance yet, and no known exploits have been reported.

Successful exploitation allows a remote authenticated attacker to execute arbitrary code, potentially leading to full system compromise including complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to module imports.