IBM Langflow OSS CVE-2026-110186

The attacker needs network reachability to a running IBM Langflow OSS instance in the 1.0.0-1.12.8 range; per the provided CVSS vector (PR:N/UI:N) no authentication or user interaction is required against a reachable instance. The precise feature, endpoint, or configuration that exposes the code-generation path is not described in the available sources, so it cannot be confirmed whether a non-default mode is required. Realistic limiting factors: exposure is constrained by whether the Langflow instance is network-accessible (many deployments are internal/developer-facing rather than internet-exposed), and by upgrading past the fixed version, which the vendor patch addresses.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated code-execution flaw (CWE-94, improper control of code generation) with full C:H/I:H/A:H impact, consistent with the 9.8 score. The vuln.today decision label is 'act_now', and IBM (the vendor, following its acquisition of the Langflow line) has shipped a patch, which together argue for immediate remediation. However, key corroborating signals are MISSING from the input: no EPSS exploitation-probability score is provided, there is no CISA KEV listing, and no PoC or exploit reference is supplied (the only reference is the vendor patch page). So while the intrinsic severity and vendor priority are high, there is no evidence in this data of active exploitation or public exploit code - the urgency rests on the act_now decision label and the unauthenticated-RCE profile rather than on confirmed in-the-wild activity. Langflow has a documented history of unauthenticated-RCE issues via code-handling endpoints, which makes the unauthenticated classification here plausible, but the specific trigger is not described in the available sources.

A remote attacker who can reach an exposed Langflow OSS instance (versions 1.0.0 through 1.12.8) sends a crafted request that abuses the improper control of code generation to inject and execute attacker-controlled code on the server. Per the CVSS vector this requires no authentication and no user interaction, and the low attack complexity means a single network request against a reachable instance could suffice. No public exploit identified at time of analysis, though the exact exploitation mechanism is not described in the supplied references.