IBM Langflow OSS CVE-2026-110196

Exploitation requires a valid low-privileged authenticated account on the target Langflow OSS instance (CVSS PR:L) and access to the application's built-in code-execution component, which the attacker configures with attacker-supplied inputs to bypass the administrator-only restriction (CWE-862). No user interaction is needed (UI:N) and the vector is network-reachable (AV:N). The principal limiting factors are the need for authentication (any low-privilege account suffices, but anonymous/unauthenticated access is not sufficient) and the affected version window 1.0.0 through 1.12.4; instances that are patched, not network-exposed, or that tightly restrict account provisioning are correspondingly harder to exploit. The description does not state whether the code-execution component is enabled by default, so verify that configuration against the vendor advisory.

This is a genuine priority, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes network-reachable, low-complexity exploitation that requires only a low-privileged authenticated account (PR:L) and no user interaction, yielding full confidentiality, integrity and availability impact - consistent with the described arbitrary code execution on the server. The CWE-862 (Missing Authorization) classification aligns precisely with the stated mechanism: a low-privileged user bypasses an administrator-only restriction to reach a built-in code-execution component. A vendor patch is available (IBM), and the vuln.today decision label is 'this_week', indicating it should be remediated promptly rather than treated as a slow-track issue. Signals are consistent rather than conflicting; the main caveat is that several independent threat signals are simply absent: no EPSS score was provided, the CVE is not on CISA KEV, and no proof-of-concept or exploit reference is supplied. There is therefore no public exploit identified at time of analysis, and the authentication requirement (a valid low-privileged account on the Langflow instance) meaningfully limits opportunistic mass exploitation. The real-world risk is highest for Langflow deployments that are internet-exposed and/or allow self-service or shared low-privilege accounts.

An attacker who holds or obtains a low-privileged authenticated account on an IBM Langflow OSS instance (versions 1.0.0 through 1.12.4) accesses a built-in code-execution component that should be restricted to administrators, and configures it with attacker-supplied inputs. Because the authorization check is missing (CWE-862), the supplied code runs on the server, giving the attacker arbitrary code execution. No public exploit has been identified at time of analysis, and no user interaction is required.