VulnSocial

CVE-2026-8476Patch(apple / langflow)

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apple langflow systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can influence cached data through file system access, malicious workflow inputs, custom components, or API manipulation can achieve complete system compromise with the privileges of the Langflow server process.

apple CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • langflow
  • linux_kernel
  • macos
  • windows

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-17); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
applelangflowlinuxmicrosoft
Products
langflowlinux_kernelmacoswindows

1 version affected across 4 products

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-17: 1Mentions · 2026-07-18: 1Mentions · 2026-07-19: 1Patch / Workaround · 2026-07-17: 1Patch / Workaround · 2026-07-19: 1Technical Details · 2026-07-17: 1Technical Details · 2026-07-18: 1Technical Details · 2026-07-19: 107-1707-1807-19
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-171
Patch1
2026-07-181
Disclosure1
2026-07-191
Patch1
Full discourse3 posts
  • ThreatAft@ThreatAft
    Patch

    🚨 Critical Langflow OSS Alert 5 vulnerabilities (4× CVSS 9.9, 1× CVSS 7.8) affect Langflow OSS 1.0.0–1.10.0, enabling RCE, privilege escalation & arbitrary file writes. 🔧 Upgrade to Langflow OSS 1.10.1 immediately. 🔗 https://threataft.com/articles/langflow-oss-critical-rce-vulnerabilities-cve-2026-9135-cve-2026-8476-cve-2026-8481-cve-2026-8635-cve-2026-8859?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #Langflow #AI #RCE https://t.co/LO5DM9Ctur

    Post summary

    The post alerts on five critical Langflow OSS CVEs with high CVSS scores and RCE exposure, recommending an immediate upgrade to version 1.10.1 to mitigate the risk.

    1001020
    34 followersView on X
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-8476 — CVSS 9.9/10 ██████████ IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/CDY9ZQHJjI

    Post summary

    The tweet announces a critical remote code execution vulnerability in IBM Langflow OSS, highlights the availability of a patch, and provides technical details but no PoC or exploit evidence.

    10000220
    68 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-8476 Critical Remote Code Execution in IBM Langflow OSS 1.0.0 Through 1.10.0 Pickle Deserialization https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8476

    Post summary

    The post announces a critical RCE vulnerability in IBM Langflow OSS (1.0.0–1.10.0) caused by pickle deserialization, providing a link to further details.

    00000128
    4.1K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
OSapplemacos---
Applangflowlangflow---
OSlinuxlinux_kernel---
OSmicrosoftwindows---

Explore more

Back to dashboardapple CVEslangflow CVEslinux CVEslangflow vulnerabilities