Langflow OSS CVE-2026-97677

Exploitation requires an authenticated account with flow-author privileges on the Langflow OSS instance (PR:L) - it is NOT remote-unauthenticated. The abuse targets the platform's local file access isolation safeguard: the attacker leverages flow authoring to write attacker-controlled file content into any directory writable by the service account, and uses a crafted on-disk index to read arbitrary files accessible to the service process (configuration files, secrets, database files under the application's data directory). Limiting factors: the attacker must already possess valid flow-author credentials, and impact is bounded by what the service account can read and write on disk; instances where flow-author access is restricted to fully trusted operators face substantially lower real-world risk. The description does not detail the precise mechanism of the isolation bypass beyond the crafted on-disk index.

This is a credible, patch-worthy issue but not a drop-everything emergency. The CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network reachability, low attack complexity, and no user interaction, but critically requires PR:L - the attacker must already be an authenticated flow author on the Langflow instance, which meaningfully narrows the threat population to users who already hold legitimate accounts. The combined C:H/I:H (arbitrary file read of secrets/config/database files plus attacker-controlled file writes into any service-writable directory) is what drives the high score, while A:N confirms no availability impact. The vuln.today Decision label is 'this_week', consistent with a serious-but-not-emergency posture. Key signals are MISSING rather than conflicting: no EPSS score was provided, there is no CISA KEV listing, and no PoC or exploit reference appears in the input - so real-world exploitation probability cannot be quantified from this data. The single reference is the IBM patch advisory, confirming vendor acknowledgement and a fix. Net: treat as a genuine priority for internet-exposed or multi-tenant Langflow deployments where flow-author accounts are not fully trusted, but the authentication barrier argues for scheduled remediation rather than crisis response.

An attacker who holds a legitimate authenticated flow-author account on a Langflow OSS instance (1.0.0-1.12.2) crafts a flow or on-disk index that abuses the local file access isolation bypass to write attacker-controlled content into a service-writable directory and to read arbitrary files the service process can access, such as configuration files, secrets, or the application's database. No public exploit code or PoC reference was identified in the available data, and exploitation requires no user interaction once the attacker is authenticated.