CVE-2026-7871 is a critical deserialization of untrusted data vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. It allows an attacker who has access to Redis to execute arbitrary code with full privileges within the application context. This can result in full compromise of the application’s secrets, data, and system integrity. The vulnerability is identified as CWE-502 and has a CVSS 3.1 base score of 9.8, indicating a network attack vector with no required privileges or user interaction, and impacts confidentiality, integrity, and availability at a high level. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation must be managed by the user.

Successful exploitation allows an attacker with Redis access to execute arbitrary code with full application privileges, leading to complete compromise of all secrets, data, and system integrity within IBM Langflow OSS. This poses a critical risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should restrict and monitor access to Redis instances used by IBM Langflow OSS to trusted administrators only and consider isolating or disabling Redis access where possible until a patch is released.