IBM Langflow OSS CVE-2026-104308

Exploitation requires an authenticated session on the target Langflow OSS instance (CVSS PR:L), limiting attacks to actors who have already obtained valid low-privilege credentials or access to a registered account; it is not exploitable by fully unauthenticated attackers. The affected versions are IBM Langflow OSS 1.0.0 through 1.12.3. The specific feature, parameter, or configuration that carries the unneutralized input into an OS command is not described in the available sources, so the precise exploitation path cannot be stated; the impact is limited to denial of service (availability only), with no confidentiality or integrity effect per the vendor rating. The primary limiting factor is the authentication requirement; no user interaction is needed (UI:N).

This is a moderate-severity, lower-priority issue rather than an emergency. The IBM-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) describes a network-reachable but authenticated (PR:L) flaw whose only impact is availability (A:L) - there is no confidentiality or integrity impact despite the CWE-78 OS-command-injection classification, meaning IBM scoped this strictly as a denial of service, not remote code execution. The vuln.today decision label is 'this_month', consistent with a non-urgent but patch-worthy item. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present, so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent (no KEV/POC, availability-only impact, authentication required) and point to a real but low real-world risk - a priority to schedule within normal patch cycles, not an out-of-band fix. One point worth verifying: the CWE-78 OS-command-injection weakness would typically carry integrity/confidentiality impact, yet IBM rated C:N/I:N; the available sources do not describe the trigger, so whether impact is genuinely limited to DoS should be confirmed with IBM.

A remote attacker who already holds valid (low-privilege) credentials on an IBM Langflow OSS instance (versions 1.0.0 through 1.12.3) submits input containing improperly neutralized special shell elements, causing the backend OS command handling to disrupt service availability. No public exploit code or PoC reference is available at the time of analysis, and the specific input vector is not described in the available sources.