IBM Langflow EUVD-2026-40382

Exploitation requires write access to the Redis data store that the affected Langflow OSS instance (1.0.0-1.10.0) reads from; the description explicitly limits this to 'users with Redis access,' which is the concrete prerequisite. This is realistic where Redis is deployed without authentication, bound to a reachable interface, or shared with other tenants/users. Limiting factors: the attacker must be able to write to the specific Redis keys Langflow deserializes, so a properly isolated, authenticated, localhost-only Redis deployment blocks the path. Note the conflict - the CVSS vector states PR:N (no privileges), but the requirement for Redis access means it is not a no-prerequisite remote-unauthenticated bug in typical hardened deployments.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) treats this as remote, unauthenticated, low-complexity with full C/I/A impact - but that rating conflicts with the description, which explicitly scopes exploitation to 'users with Redis access.' This is a material discrepancy: PR:N implies no privilege, yet write access to the Langflow Redis instance is a real prerequisite, so the practical privilege requirement is higher than the vector suggests - verify with the vendor. Real-world risk therefore hinges on Redis exposure: deployments that bind Redis to localhost or require Redis AUTH substantially limit reach, whereas the common pattern of unauthenticated Redis on an internal or (misconfigured) external network makes exploitation trivial and devastating. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so this is a high-impact but not-yet-known-exploited issue; the impact ceiling (full RCE and secret theft) justifies prompt patching despite the access precondition. Treat the headline 9.8 as an upper bound rather than a confirmed unauthenticated-internet-facing risk.

An attacker who reaches the Langflow Redis backend - for example an unauthenticated Redis instance exposed on an internal network or a low-privileged user already able to write to it - stores a crafted serialized payload under a key Langflow later reads. When Langflow deserializes that value it reconstructs the malicious object and executes the attacker's code with full application privileges, allowing theft of all stored secrets and full host compromise. No public POC is referenced, but the attack is conceptually straightforward for anyone with Redis write access.