CVE-2026-8056 is a code injection vulnerability (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.10.0. The issue arises from insufficient filtering of parameters in the apply_tweaks() function, which enables authenticated users to override component parameters at runtime through the API. This improper control of code generation can lead to execution of arbitrary code, compromising system security. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary code within the IBM Langflow OSS environment. This can lead to full compromise of the affected system, including unauthorized access to sensitive data, modification or destruction of data, and disruption of service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been provided at this time. Until a patch is available, restrict access to the API to trusted users only and monitor for suspicious activity related to parameter overrides in the apply_tweaks() function.