CVE-2026-7524

⛔ critical

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.

CVSS Score

9.8

Critical

EPSS Score

0.4

Exploit Probability

Published Date

2026-05-27

First Seen: 2026-05-28

This CVE is Very High Risk - more severe than 90.5% of all 326,604 vulnerabilities in our database.

#31,067

Top 10% most severe

Severity Percentile

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

This vulnerability was reported to IBM by Ori Lahav (Rubrik Inc.) orilahav@tauex.tau.ac.il.

SSVC data provided by CISA

Last Modified 2026-06-02

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-22

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
langflow	langflow	Affected	> 1.0.0 < 1.9.1

Vendor Advisory

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-7528	⚠️ high	7.1	0.1	IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.	2026-05-27
CVE-2026-42048	⛔ critical	9.6	0.0	Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to...	2026-05-12
CVE-2026-6542	🔶 medium	6.5	0.0	IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build ...	2026-04-30
CVE-2026-3357	⚠️ high	8.8	0.6	IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the sys...	2026-04-08
CVE-2026-5022	🔶 medium	5.3	0.1	The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, a...	2026-03-27
CVE-2026-5025	🔶 medium	6.5	0.0	The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log...	2026-03-27

These CVEs affect the same products