IBM Langflow OSS CVE-2026-14470

Exploitation requires a valid authenticated session with at least low-privilege credentials on the target IBM Langflow OSS instance (PR:L per CVSS vector) - unauthenticated exploitation has not been identified. No special non-default configuration or deployment mode is required beyond running an unpatched version in the 1.0.0-1.10.2 range. The attacker must have network-level access to the Langflow web interface; in typical enterprise deployments this interface may be restricted to internal networks, which meaningfully limits the external attack surface. Limiting factors are the authentication requirement (no anonymous exploitation path confirmed), the read-only impact (no file write, command execution, or privilege escalation directly from this vector), and the dependency on the target filesystem containing sensitive files at traversable paths.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is well-calibrated: network-exploitable with low complexity, but gated behind a valid authenticated session, and limited to confidentiality loss with no integrity or availability impact. Real-world risk depends heavily on what sensitive data is accessible via the filesystem - Langflow instances frequently store LLM provider API keys, workflow secrets, and configuration files that, if disclosed, could enable lateral movement or API abuse. EPSS data is absent from the available intelligence, so a quantitative exploitation probability cannot be assigned; however, the combination of low attack complexity and high confidentiality impact means that even a mid-sized municipal IT team in gdynia operating an AI automation platform should treat this as a prompt patching priority rather than deferring it. No active exploitation (KEV) or public proof-of-concept has been identified, which reduces immediate urgency but does not eliminate it, particularly for externally accessible Langflow deployments.

An attacker who has obtained valid low-privilege credentials - for example, a compromised developer API token or an insider with a standard Langflow account - sends a crafted HTTP GET request to the Langflow server with a path such as /api/v1/files/../../../../etc/passwd or targeting application configuration directories containing LLM API keys. The server resolves the traversal without sanitization and returns the file contents in the response. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the technique is straightforward to reproduce once authentication is established.