Langflow CVE-2026-81204

Exploitation requires network reachability to a Langflow OSS instance running 1.0.0 through 1.11.5 and the ability to submit a flow/graph definition that is processed by the vulnerable graph-construction path; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required against a reachable instance. The primary limiting factor is exposure and access control: instances that require authentication before flows can be created/built, or that are not network-reachable by the attacker, are correspondingly harder to exploit, and only the affected version range 1.0.0-1.11.5 is impacted.

This is a genuine high-priority issue: the CVSS 3.1 base score of 9.8 aligns with the vector (network, low complexity, no privileges, no user interaction, high C/I/A), and CWE-94 code injection yielding RCE is directly actionable. Weighing the signals - a vendor patch is confirmed available from IBM, no EPSS score, KEV listing, or public POC is present in the provided data, so exploitation should be treated as no public exploit identified at time of analysis rather than active in-the-wild use. The main caveat is exposure: Langflow instances that are internet-reachable or lack authentication in front of the graph-build endpoint face the full unauthenticated-RCE risk, whereas instances behind auth/network controls are meaningfully harder to reach, and any operator running an affected version should treat patching as urgent given the pre-auth, low-complexity nature of the flaw.

An attacker discovers an internet-exposed Langflow OSS instance (1.0.0-1.11.5) and submits a crafted flow or component definition to the graph-construction endpoint. During graph build, the malicious payload is evaluated as Python, giving the attacker arbitrary code execution in the server process with the privileges of the Langflow service. No public exploit is identified at this time, but the low-complexity, unauthenticated vector makes weaponization straightforward.