CVE-2026-3357

⚠️ high

Summary

IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.

CVSS Score

8.8

High

EPSS Score

0.6

Exploit Probability

Published Date

2026-04-08

First Seen: 2026-04-09

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 326,604 vulnerabilities in our database.

#61,754

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 8, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

This vulnerability was reported to IBM by Weblover.

SSVC data provided by CISA

Last Modified 2026-04-14

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-502

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
langflow	langflow	Affected	> 1.6.0 < 1.8.3

🔗 References 1

https://www.ibm.com/support/pages/node/7268428

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-7524	⛔ critical	9.8	0.4	IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links duri...	2026-05-27
CVE-2026-7528	⚠️ high	7.1	0.1	IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.	2026-05-27
CVE-2026-42048	⛔ critical	9.6	0.0	Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to...	2026-05-12
CVE-2026-6542	🔶 medium	6.5	0.0	IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build ...	2026-04-30
CVE-2026-5022	🔶 medium	5.3	0.1	The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, a...	2026-03-27
CVE-2026-5025	🔶 medium	6.5	0.0	The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log...	2026-03-27

These CVEs affect the same products