{
 "id": "AIR-2026-1192",
 "slug": "cve-2026-8476-ibm-langflow-oss-remote-code-execution-via-uns",
 "title": "CVE-2026-8476: IBM Langflow OSS remote code execution via unsafe pickle deserialization",
 "summary": "IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an RCE vulnerability in the AsyncDiskCache class due to the use of unsafe pickle deserialization. Attackers able to influence cached data can achieve complete system compromise.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "supply_chain"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow"
 ],
 "incident_date": "2026-07-17",
 "incident_date_precision": "day",
 "first_reported": "2026-07-17",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8476",
   "publisher": "NVD",
   "title": "CVE-2026-8476: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism.",
   "published_at": "2026-07-17"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-8476",
  "langflow",
  "insecure-deserialization",
  "rce"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}