CVE-2026-8476 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability arises from the AsyncDiskCache class deserializing cached objects from disk using Python's pickle.loads() function without any validation, integrity checks, or authentication. Because pickle is unsafe when handling untrusted data, an attacker able to influence the cached data—via file system access, malicious workflow inputs, custom components, or API manipulation—can execute arbitrary code remotely with the privileges of the Langflow server process. This results in a critical remote code execution vulnerability with a CVSS 3.1 base score of 9.9.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected system with the privileges of the Langflow server process, potentially leading to full system compromise. Confidentiality, integrity, and availability of the system are all severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor access to the file system and inputs that can influence cached data to reduce risk. Avoid using or deploying affected versions in untrusted environments.