CVE-2026-9196 is a code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw occurs during the validation phase of the Agentic Assistant feature, where the application executes Python code generated by a large language model (LLM) in the backend prior to user approval. Improper control of this code generation allows an authenticated attacker to inject and execute arbitrary code, which can lead to unauthorized network access, file system interactions, or data exfiltration with the privileges of the Langflow backend process.

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary Python code on the backend server running Langflow OSS. This can result in high confidentiality and integrity impact, including unauthorized outbound network communications, manipulation or access of files on the server, and potential data exfiltration. The availability impact is not indicated. The CVSS v3.1 base score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users only and monitor for suspicious activity related to Agentic Assistant validation. Avoid running Langflow OSS in high-privilege contexts and consider isolating the backend process to limit potential impact of code execution.