CVE-2026-10561 -- CVSS 10.0 Vulnerability Briefing
CVE-2026-10561 | CVSS 10.0 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-10561 is a critical remote code execution vulnerability in Langflow (versions 1.0.0 through 1.9.3), an open-source AI workflow orchestration platform, caused by improper Python execution isolation combined with an authentication bypass.
Technical Detail
The vulnerability arises from two compounding weaknesses: an authentication bypass that allows unauthenticated access to protected API endpoints, and insufficient sandboxing of the Python execution environment used to run user-defined workflow logic. An unauthenticated remote attacker can reach these endpoints and submit crafted payloads that execute arbitrary Python code in the context of the Langflow server process. Successful exploitation results in full remote code execution with the privileges of the running service, potentially enabling complete host compromise, data exfiltration, or lateral movement within the hosting environment.
Exploitation Status
No known exploit code has been publicly observed as of June 29, 2026, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time. However, the combination of a CVSS 10.0 score, unauthenticated attack vector, and confirmed interest from sophisticated threat actors significantly elevates the risk of exploitation in the near term.
Who Is Targeting This
Confirmed (ATTAX-verified): TA577 (origin unspecified, motivation unknown), Lazarus Group (DPRK, nation-state motivation), and Moonstone Sleet (DPRK, nation-state motivation) have all been associated with this vulnerability at high confidence. Reported (research-inferred): MOONSTONESLEET and LAZARUSGROUP have been identified through research-inferred attribution at medium confidence, consistent with the confirmed actor set. One additional entry carries no public attribution at medium confidence. The presence of two distinct DPRK-linked groups at high confidence is notable and suggests this vulnerability is of active strategic interest to North Korean cyber operations, which have historically targeted AI development infrastructure and financial systems.
What To Do
Organizations running Langflow 1.0.0 through 1.9.3 should treat this as a priority patch given the CVSS 10.0 score and confirmed nation-state actor interest. Upgrade to the latest patched release immediately and verify that Langflow instances are not exposed to the public internet without strict network-layer access controls. If immediate patching is not possible, restrict access to Langflow API endpoints via firewall rules or reverse proxy authentication enforcement as an interim measure. Audit server logs for anomalous unauthenticated requests to workflow execution endpoints, unexpected outbound connections, or signs of Python subprocess spawning. Given the DPRK actor attribution, defenders should also monitor for post-exploitation behaviors consistent with Lazarus Group and Moonstone Sleet tradecraft, including credential harvesting, persistence mechanisms, and cryptocurrency-related tooling deployment.