IBM Langflow CVE-2026-19295

Requires a valid authenticated Langflow account with permission to create/save flows and trigger a build (CVSS PR:L confirms low-privilege authentication is needed, not anonymous access). The concrete prerequisites are: the attacker must save a flow with a crafted 'type' field value and then build a wrapper flow that references that malicious flow - the build/type-resolution step is what fires the injection. Notably, exploitation succeeds even when LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false, so that hardening setting does NOT limit it. Limiting factors that reduce real-world exposure: an account is required (so non-internet-facing or single-user instances are largely protected), and the affected version range is 1.0.0 through 1.11.1 only. No user interaction from a victim is needed.

The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, only low privileges required, no user interaction, scope change, and full confidentiality/integrity/availability loss - consistent with unauthenticated-adjacent RCE once any account exists. The key mitigating signal is PR:L: the attacker must already be an authenticated flow user, so exposure depends heavily on whether the Langflow instance is internet-facing and how loosely accounts are provisioned. No EPSS score, KEV entry, or POC was provided, so the practical exploitation-likelihood signals are absent rather than low; this should be treated as high-priority patching because the flaw defeats an explicit security control (LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false) that many operators rely on as their primary containment for multi-user deployments. In short: high real-world risk for any shared/multi-tenant Langflow deployment, lower for single-operator localhost installs.

An attacker with a low-privileged Langflow account creates and saves a flow whose 'type' field is set to a malicious value, then saves a second wrapper flow referencing it and triggers a build. During the build, the server resolves and evaluates the crafted type, executing the attacker's OS commands as the Langflow server process - for example spawning a reverse shell or reading server secrets. Given AV:N/AC:L, this is a straightforward request-driven attack for anyone holding valid credentials; no public exploit is identified at time of analysis.