IBM Langflow OSS CVE-2026-19303

Exploitation requires a valid Langflow user account (PR:L - low privilege is sufficient; no administrative role is needed). The attack is network-based with no special network positioning required. No user interaction beyond the attacker's own authenticated session is needed. The vulnerability appears to affect all default deployments of IBM Langflow OSS 1.0.0-1.11.2 without any non-standard configuration requirement. Limiting factors: an attacker without any valid account cannot exploit this flaw; organizations enforcing strong authentication (MFA, SSO) or limiting account provisioning reduce exposure significantly. The impact is restricted to file/directory deletion - data exfiltration via this path is not indicated.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately reflects the threat model: a network-reachable, low-complexity attack requiring only a low-privilege account. The high integrity and availability scores are well-founded - deleting configuration files, model artifacts, or system binaries could render the Langflow instance or its host inoperable. No EPSS data was provided, and neither KEV listing nor public POC has been identified, which limits prioritization urgency for organizations with strict authentication controls and limited account exposure. However, in environments where Langflow accounts are broadly provisioned (e.g., developer-facing AI sandboxes or shared research instances), even a low-privilege insider or compromised user credential presents a meaningful destructive capability. AC:L means no special race condition or complex prerequisite is required beyond authentication. The absence of confidentiality impact reduces the risk of data exfiltration but does not diminish the sabotage or denial-of-service potential.

An attacker with a valid low-privilege Langflow account (or a compromised credential) submits an HTTP request to a file-management endpoint with a path parameter containing traversal sequences (e.g., '../../etc/passwd' or '../../app/config.yaml'), causing the server to delete the targeted file outside the intended directory. Repeated calls could systematically destroy configuration, model weights, or runtime dependencies, causing a full service outage. No public exploit code has been identified at time of analysis.