IBM Langflow OSS CVE-2026-18899

No special conditions are required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation against IBM Langflow OSS in its default configuration across all versions 1.0.0 through 1.11.1. Network reachability to the Langflow OSS HTTP interface is the only prerequisite. Factors that limit exploitation: the impact is strictly read-only (C:H/I:N/A:N), so direct code execution or data modification are not possible through this vector; file access is bounded by the operating system permissions of the process account running Langflow; deployments restricted to internal networks or behind authenticated proxies are not directly exploitable from the internet.

The CVSS 3.1 base score of 7.5 (High) accurately reflects the attack profile: unauthenticated, network-accessible, low complexity, no user interaction, with high confidentiality impact. EPSS data is absent from the available intelligence, limiting probabilistic exploitation forecasting - this is a gap in the current signal picture. KEV status is not confirmed and no public POC has been identified, which moderates immediate urgency relative to the raw CVSS score. However, path traversal vulnerabilities of this class are well-understood and frequently weaponized quickly after disclosure, so the window between patch release and exploitation attempts is typically short for internet-exposed instances. The impact is bounded to read-only access (I:N, A:N), meaning direct code execution or data modification is not possible through this vector alone - but files read (credentials, API keys, private keys, configuration) may enable secondary attacks. Internal deployments behind access controls carry substantially lower real-world risk.

An unauthenticated attacker sends a crafted HTTP request to an internet-exposed IBM Langflow OSS instance, embedding path traversal sequences (e.g., '../../etc/passwd' or '../../app/config.yaml') in a parameter the application passes unsanitized to a server-side file-read operation. The server returns the targeted file contents without restricting access to a safe base directory. By iterating requests, the attacker exfiltrates sensitive files such as database credentials, LLM API keys, or TLS private keys, enabling lateral movement or secondary compromise.