1. Home
  2. CVE Database
  3. CVE-2026-6543
HIGH · 8.8

CVE-2026-6543

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variab...

Vulnerability Description

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
LangflowLangflow Desktop>= 1.0.0, <= 1.8.4

Related Weaknesses (CWE)

CWE-94

References

FAQ

What is CVE-2026-6543?

CVE-2026-6543 is a vulnerability with a CVSS score of 8.8 (HIGH). IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variab...

How severe is CVE-2026-6543?

CVE-2026-6543 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-6543?

Check the references section above for vendor advisories and patch information. Affected products include: Langflow Langflow Desktop.