Detections
Analytics
SCA: security update for langflow (GHSA-v798-mcc6-2m3m)
critical Tenable Cloud Security Plugin ID 477278
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and
read sensitive files including credentials, enabling complete system compromise and lateral movement.
(CVE-2026-7873)
Solution
Update the langflow library and its related packages to version 1.10.1.rc0 or later.See Also
Plugin Details
Severity: Critical
ID: 477278
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/24/2026
Updated: 10/24/2026
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.17
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-7873
CVSS v3
Risk Factor: Critical
Base Score: 9.9
Temporal Score: 9.2
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/30/2026
Vulnerability Publication Date: 6/30/2026
Exploitable With
Metasploit (Langflow AI Code Validation Authenticated RCE)
Reference Information
CVE: CVE-2026-7873
cwe: CWE-94