IBM Langflow OSS CVE-2026-84889

Exploitation requires a valid authenticated session on IBM Langflow OSS with at least low-privilege access (PR:L per CVSS). No special non-default configuration or specific feature flag is stated as a prerequisite in the available data - any authenticated user on an affected version (1.0.0-1.10.3) may be able to trigger the path traversal. Network accessibility is required (AV:N); there is no adjacent-network or local-only restriction. The primary limiting factor is the authentication requirement: an attacker must first obtain valid credentials before exploiting the flaw. The exact vulnerable endpoint or Langflow feature is not specified in the available intelligence and must be confirmed from the IBM advisory.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity network-exploitable flaw with low complexity and full compromise potential. The authentication barrier (PR:L) meaningfully reduces attack surface versus unauthenticated flaws, but in AI/ML platform contexts Langflow credentials are typically distributed among data scientists and developers, widening the effective attacker pool. No EPSS score is available in the provided intelligence, so exploitation probability cannot be quantified. No KEV listing is present. The path-traversal-to-RCE class is well-understood with reliable exploitation techniques once the traversal primitive is located, so the low CVSS complexity rating is credible. The IBM advisory is the sole reference; no independent third-party analysis or POC has been identified. Risk is elevated for organizations running Langflow OSS instances accessible beyond strictly controlled internal networks.

An attacker with a valid low-privilege Langflow account - such as a developer or data scientist - crafts an API request to a file-handling endpoint (e.g., component upload, flow import) embedding directory traversal sequences in a path parameter. The traversal escapes the application's restricted directory, allowing the attacker to write a malicious script or overwrite an application-loaded file outside the intended sandbox. The Langflow process subsequently executes the payload, granting the attacker code execution under Langflow's runtime privileges.