IBM Langflow OSS CVE-2026-81211

Exploitation requires a valid authenticated user account with at least low-privilege access to the Langflow instance (CVSS PR:L). The specific vulnerable feature is the custom Python component mechanism within stored flows - the attacker must have the ability to create or modify a stored flow and embed a custom component definition. Network access to the Langflow server is required (AV:N). Exploitation is not possible without authentication; unauthenticated access is not a vector here. Deployments where all users are trusted or where custom component creation is restricted to administrators face significantly reduced risk.

CVSS 3.1 scores this 8.8 (High) with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The PR:L metric is the critical constraint: exploitation requires a valid user account, not anonymous access. However, in multi-tenant or organizationally shared Langflow deployments - a common configuration for team-based AI pipeline development - a single compromised or malicious low-privileged account translates directly to full server-side code execution. Attack complexity is low once the attacker holds credentials. No EPSS score was provided in available data, and this CVE is not listed in CISA KEV, so exploitation probability cannot be quantified. No public exploit code has been identified at time of analysis. The practical risk is highest for deployments where multiple untrusted users share a single Langflow instance; self-hosted single-user instances face materially lower risk since the attacker would already be the authorized operator.

An attacker with a valid low-privilege Langflow account creates a new stored flow containing a custom Python component that spawns an outbound reverse shell or exfiltrates environment variables and credentials from the host. The attacker then triggers flow execution via the Langflow API or UI, causing the server to evaluate the malicious Python in its own process context. No public proof-of-concept has been identified, but the exploitation path is straightforward for anyone familiar with Langflow's custom-component feature.