IBM Langflow OSS CVE-2026-79725

Exploitation requires a valid authenticated session with at least low-privilege access to IBM Langflow OSS (confirmed by PR:L in CVSS vector). The attacker must have network access to the Langflow OSS API endpoint (AV:N/AC:L). No user interaction is required beyond the initial credential acquisition. Exploitation is limited to authenticated users - unauthenticated remote attackers cannot exploit this flaw directly. The vulnerability affects versions 1.0.0 through 1.11.5; instances upgraded beyond this range or access-restricted to only highly trusted accounts are not exploitable under normal conditions.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a medium-severity finding with high confidentiality impact but zero integrity or availability impact. The PR:L requirement is the key limiting factor: an attacker must first obtain valid credentials to the Langflow OSS instance before exploiting the file-read flaw. This significantly narrows the realistic attacker population to insiders, credential-phishing victims, or previously compromised accounts. Attack complexity is low once credentials are obtained. EPSS data is not provided; without KEV listing or public POC, exploitation probability appears low at time of analysis. The C:H rating is legitimate - arbitrary file read on an AI workflow server could expose model configurations, API keys, database credentials, or host system files (/etc/passwd, private keys), which could enable privilege escalation or lateral movement. Real-world risk is therefore moderate: low exploitation likelihood but high post-exploitation value if credentials are compromised.

An attacker who has obtained valid low-privilege credentials to an IBM Langflow OSS instance - for example, through credential stuffing, phishing, or reuse of leaked credentials - authenticates and then issues crafted API requests specifying file paths outside the intended application scope. The server, lacking proper authorization checks on file references, returns the contents of arbitrary files such as environment variable files, private TLS keys, or cloud provider credential files stored on the host, enabling further lateral movement or privilege escalation.