IBM Langflow CVE-2026-10134

Requires network reachability to a Langflow OSS 1.0.0-1.9.3 instance and the ability to submit or modify a flow and trigger its build through the /api/v1/build/... API; the injected payload lives in the flow's tool_code field, which the runtime executes. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required against a default configuration, so exposure of the Langflow API to an attacker is effectively the only precondition. Limiting factors: the instance's flow/build API must be reachable by the attacker - deployments that place Langflow behind authentication, network segmentation, or that disable anonymous flow creation substantially raise the bar, and persistence via modifying a public flow specifically depends on a shared/public flow being present and re-built by other users.

All available signals point to top-tier priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, i.e. network-reachable, low-complexity, unauthenticated, no user interaction, with a scope change and full confidentiality/integrity/availability impact - yielding the maximum base score of 10.0. The scope change is corroborated by the description's claim of cross-tenant lateral movement and persistence via re-executed tool_code. EPSS is not provided in the input, so exploitation probability cannot be quantified, and there is no KEV listing or POC reference, so this is not yet confirmed as actively exploited. The combination of unauthenticated network RCE with persistence on a developer-facing AI platform makes weaponization plausible despite the absence of a published exploit; treat as critical and patch immediately rather than waiting for EPSS/KEV confirmation. No metric conflicts are evident - the description (network-facing API abuse, code re-execution) is consistent with the AV:N/PR:N vector.

An attacker reaches an internet- or network-exposed Langflow instance, submits or modifies a flow so that its tool_code contains malicious Python, and triggers a build via /api/v1/build/... to execute it as the Langflow process. They harvest environment secrets and database contents, query the cloud metadata endpoint for credentials, and overwrite a public flow's tool_code so that routine builds by other users silently re-run their payload, establishing persistence and cross-tenant access. No public exploit is identified at time of analysis, but the low attack complexity makes such a chain straightforward.