IBM Langflow OSS CVE-2026-104317

The exact concrete prerequisite stated in the description is network reachability to the message broker component used by IBM Langflow OSS - an attacker who can reach that broker can deliver a malicious serialized message that Langflow deserializes. Affected deployments are Langflow OSS versions 1.0.0 through 1.12.3. The principal limiting factor is exposure of the message broker: brokers are frequently bound to internal or segmented networks rather than being internet-facing, so despite the AV:N/PR:N CVSS metrics, exploitation in practice depends on the attacker having a network path to the broker; the available sources do not state whether the broker enforces authentication, so an auth requirement cannot be confirmed from the data.

Raw severity is maximal (CVSS 9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) for a CWE-502 unsafe-deserialization flaw yielding remote code execution, and the vuln.today Decision label is act_now with a vendor patch already available - both arguing for priority remediation. However, the signals are not fully aligned: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (only Technical Impact is 'total'), which points to a serious but not yet actively or automatically exploited condition rather than a mass-exploitation emergency. No EPSS score was provided, so exploitation probability cannot be quantified here, and the CVE is not listed in CISA KEV. Critically, the CVSS vector scores AV:N/PR:N, but the description qualifies the attacker as one 'who could reach the message broker' - message brokers are commonly deployed on internal/segmented networks rather than internet-exposed, so the realistic attack surface is narrower than the network/unauthenticated metrics alone imply; verify broker exposure in your environment. Net assessment: treat as a high-priority patch given total technical impact and act_now labeling, but the SSVC 'exploitation none / automatable no' signals and the broker-reachability prerequisite suggest this is not (yet) a wormable, internet-wide crisis.

An attacker with network reachability to the message broker used by IBM Langflow OSS sends a crafted serialized message that the application deserializes without validation, causing attacker-controlled code to run on the host. Because the broker is the entry point, the practical requirement is network access to that broker rather than any authenticated Langflow session. No public exploit code or PoC reference was provided in the available data.