IBM Langflow OSS CVE-2026-93680

The description states only that the flaw is 'improper authentication' permitting a bypass of security restrictions; it does not name the specific endpoint, API, protocol, or configuration setting involved, so the exact trigger is not described in the available sources. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires network reachability of the Langflow OSS instance but no authentication, no elevated privileges, and no user interaction, implying default-configuration exploitability against versions 1.0.0 through 1.12.8. The primary limiting factor is network exposure: instances not reachable by the attacker (e.g., behind authentication proxies, VPN, or restricted to localhost) reduce real-world exploitability, and the version ceiling (≤1.12.8) bounds the affected population.

All available signals point to a genuine high priority, though some corroborating data is thin. The CVSS 3.1 base vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable flaw requiring no privileges and no user interaction, with total compromise of confidentiality, integrity, and availability - consistent with an authentication bypass (CWE-287) that hands an unauthenticated remote attacker the access controls are meant to deny. The vuln.today decision label is act_now and IBM (the reporting vendor, which owns Langflow OSS via its DataStax acquisition) has shipped a patch, so remediation should be treated as urgent rather than deferred. Countervailing context: no EPSS probability was supplied, the CVE is NOT listed in CISA KEV, and no public exploit or PoC reference is present in the input - only a vendor patch page. So there is no evidence of active exploitation or weaponization at this time; the urgency derives from the trivial-to-exploit CVSS profile and vendor-reported severity, not from observed in-the-wild activity. The main uncertainty is mechanistic: the description states only 'improper authentication' and does not say which endpoint, API, or auth flow is affected, so the real-world reachability of the bypass in a given deployment cannot be confirmed from the data provided.

A remote attacker who can reach a Langflow OSS instance (version 1.0.0 through 1.12.8) over the network sends requests to an affected endpoint and bypasses the authentication/security restrictions, gaining access that should require valid credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, elevated privileges, or user interaction are needed. No public exploit or PoC was identified in the provided data, so this scenario is inferred from the CVSS profile rather than from released exploit code.