CVE-2026-17632 is a code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw arises from improper validation of Python code during AST-based security scanning, which could allow a remote attacker with authentication privileges to execute arbitrary code on the affected system. This vulnerability is categorized as CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

An authenticated remote attacker could exploit this vulnerability to execute arbitrary code on the affected system, potentially leading to full compromise including unauthorized access, data manipulation, or denial of service. The high CVSS score reflects significant impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor IBM's advisories for updates and apply patches once available. Until then, limit access to trusted authenticated users and consider additional security controls to reduce risk.