IBM Langflow CVE-2026-14499

Exploitation requires an authenticated Langflow account (CVSS PR:L) and the ability to reach and use the Python Interpreter component within a flow - that specific component is the vulnerable feature named in the description. No user interaction by a victim is required (UI:N) and the attack is performed over the network against the Langflow application (AV:N) with low complexity (AC:L). The principal limiting factors are: the attacker must be logged in (not unauthenticated), the instance must be network-reachable to the attacker, and the affected version must be in the 1.0.0-1.10.1 range; there is no indication a non-default configuration is needed beyond having the Python Interpreter component available.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High) indicates a network-reachable attack with low complexity, requiring only low privileges (an authenticated but not necessarily administrative account), no user interaction, and full confidentiality/integrity/availability impact - a strong risk profile. The key mitigating factor is PR:L: the attacker must first hold a valid Langflow account, so this is not an unauthenticated internet-wide exploit. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input; treat those as unknown rather than low. There is no signal-conflict here - the description ('authenticated user', 'Python Interpreter component') is consistent with PR:L and AV:N. Given command injection root cause and a component that already runs code, real-world exploitability once authenticated is high, so this should be prioritized wherever Langflow accounts are broadly provisioned or the instance is internet-exposed.

An attacker who has obtained any valid Langflow account - through self-registration, weak credentials, or a compromised low-privilege user - builds or edits a flow that uses the Python Interpreter component and supplies crafted input containing OS command syntax. When the flow runs, the injected commands execute in the host shell at the Langflow service's privilege level, giving the attacker command execution and potential full host compromise. No public exploit code was identified in the provided intelligence, but the low attack complexity means a working exploit would be straightforward to develop.