Langflow OSS CVE-2026-107328

Exploitation requires a valid authenticated session with at least low privileges (PR:L) on a network-reachable Langflow OSS instance in the 1.0.0-1.12.4 range; no user interaction is needed (UI:N). The specific product feature, component, or endpoint whose input reaches the eval/exec sink is not described in the available sources, so it cannot be confirmed whether a non-default configuration is required. The primary limiting factor is the authentication requirement - attackers must already possess credentials or an account - which constrains exploitation to insiders or attackers who have obtained valid access, rather than fully anonymous internet-wide attackers.

This is a genuine high-severity concern but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L), yielding total compromise (C:H/I:H/A:H) consistent with arbitrary code execution via CWE-94. The signals are internally consistent but point to a measured, not frantic, response: the SSVC decision framework reports Exploitation: none and Automatable: no, while rating Technical Impact as total - meaning severe consequence if triggered, but no evidence of active exploitation or scalable automated attacks. This aligns with the vendor's 'this_week' priority (fix promptly, not an emergency drop). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit reference, so there is no public exploit identified at time of analysis. The main gating factor is that exploitation requires authentication, which narrows the attacker population to users who already have valid (even low-privilege) access to the Langflow instance. Net: a real priority to patch within the vendor's recommended window, but current data does not indicate widespread or automated exploitation.

An attacker who already holds low-privilege authenticated access to an IBM Langflow OSS instance (1.0.0-1.12.4) submits input that is passed to an eval/exec code path without proper neutralization, causing attacker-controlled Python to run on the server. Given the network attack vector and low complexity, this requires no victim interaction once the attacker is authenticated. No public exploit was identified at time of analysis.