CVE-2026-9135 is a code injection vulnerability (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.10.0 (up to commit 94981c443d4918517b9e8163d70fc598dc33a32d). The issue arises because the validation mechanism only checks the main component source code but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers with flow creation privileges can embed malicious Python code in these unvalidated fields, which are persisted and executed server-side when invoking guarded tools. The vulnerability bypasses the allow_custom_components=false control and can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters. Misconfigurations such as AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true can reduce authentication barriers, increasing exploitability.

Successful exploitation allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend server, potentially leading to full system compromise. The vulnerability also enables cross-tenant code injection, allowing attackers to manipulate victim users' flows. The CVSS 3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict flow creation privileges to trusted users only and review configurations to avoid AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true settings that reduce authentication requirements. Monitor for updates from IBM regarding patches or official mitigations.