IBM Langflow CVE-2026-12944

Requires an authenticated Langflow user (CVSS PR:L) who can submit or edit flow components; the malicious component must include socket or urllib imports, which the flawed validator fails to reject. Full impact depends on deployment: AWS IAM credential theft requires the server to run in a cloud environment reachable to IMDSv1 (169.254.169.254) with an attached instance role, and lateral movement requires PostgreSQL/Redis reachable on the same Docker network. Limiting factors are the authentication requirement, the need for component-submission privileges, and running as root inside the container (default in affected images) - hardened non-root or network-egress-restricted deployments materially reduce impact.

The signals align toward genuine priority: CVSS 9.6 with AV:N/AC:L/PR:L/UI:N/S:C and a public gist-hosted exploit. The one real barrier is PR:L - an attacker needs an authenticated Langflow account able to submit components, so this is not fully unauthenticated internet-wide mass exploitation. That caveat matters, because many Langflow instances are exposed with weak or default auth, and any low-privileged user then obtains root code execution plus cloud IAM credential theft, so an exposed mid-sized operator should treat this as urgent rather than routine. EPSS is not provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active in-the-wild exploitation yet - but publicly available exploit code substantially lowers the effort to weaponize. The vendor-scored A:N understates impact given root RCE; the practical blast radius (credential theft, lateral movement) is high. Overall: high real-world risk where Langflow is network-exposed, moderated by the authentication prerequisite.

An attacker with a low-privileged Langflow account creates a flow component whose Python body imports socket/urllib; the scanner marks it "validated": true and the server executes it as root. The code queries IMDSv1 for the instance IAM role credentials and connects to internal PostgreSQL/Redis, giving the attacker cloud credentials and lateral movement. Public exploit code for this technique is already available.