IBM Langflow OSS CVE-2026-8635

Exploitation requires an authenticated Langflow account (CVSS PR:L) with network reachability to the Langflow OSS 1.0.0-1.10.0 web service (AV:N); no user interaction and low complexity are needed once that access is held. The concrete prerequisite from the description is the ability to directly manipulate the underlying database to set the superuser role, which then unlocks arbitrary system command execution. Limiting factors: the attacker cannot be fully anonymous (some valid credentials or account are required), so risk is highest in multi-tenant, shared, or internet-exposed instances and in deployments that allow open/self-service registration; single-user or network-isolated instances behind a VPN materially reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is internally consistent with the description: network reachable, low complexity, requires low (authenticated) privileges, no user interaction, scope change, and full CHI impact - yielding a critical 9.9. The one real gating factor is PR:L: an attacker must already be an authenticated Langflow user, which limits blast radius to environments where accounts are provisioned to untrusted or lower-trust users, or where credentials can be obtained. There is no EPSS score, no KEV listing, and no POC in the provided data, so exploitation probability cannot be quantified - this is a high-severity, patch-now issue on impact grounds, but there is no evidence of active or widespread exploitation yet. The scope change (S:C) and full-compromise outcome make it a genuine priority rather than an inflated score, particularly for multi-tenant or internet-exposed Langflow deployments.

An attacker who holds or obtains any low-privileged Langflow account authenticates to the platform, then directly manipulates the backing database to promote their account to superuser. With superuser role they invoke Langflow's code/command execution capability to run arbitrary system commands, gaining a shell with the Langflow service account's permissions and full control of the host. No public exploit is identified at time of analysis, and low attack complexity (AC:L) with no required user interaction makes the chain straightforward once authenticated.