IBM Langflow OSS EUVD-2026-45236

Exploitation requires that the target run a default Langflow OSS deployment (versions 1.0.0-1.10.0) with the auto_login feature enabled, which mints SUPERUSER tokens to any unauthenticated network caller, and that both the /api/v1/auto_login and /api/v1/validate/code endpoints be network-reachable by the attacker. Under those conditions there are no further prerequisites - remote unauthenticated exploitation against default configurations of IBM Langflow OSS (AV:N/AC:L/PR:N/UI:N). Exploitation is limited where auto_login has been disabled (LANGFLOW_AUTO_LOGIN=false) with real authentication configured, or where the service is not directly reachable (internal network, VPN, or authenticating reverse proxy), since the token-minting step then fails and the code-validation endpoint cannot be reached anonymously.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated attack with full impact, and the two-endpoint chain described maps cleanly to that vector - auto_login supplies the missing authentication and validate/code supplies code execution, so all preconditions are attacker-satisfiable against defaults. EPSS and SSVC data were not provided, so exploitation probability and automatability cannot be quantified from the input; however, the pattern (unauthenticated RCE in an internet-facing AI dev tool via exec()) is highly automatable and historically attracts mass scanning once a POC circulates. No KEV listing and no POC were supplied, so exploitation is not confirmed active - but the low barrier to weaponization means defenders should treat exposed instances as urgent. The main mitigating factor is deployment exposure: Langflow is often run on internal networks or behind auth proxies, which would blunt the AV:N assumption.

An attacker scanning for internet-exposed Langflow instances sends an unauthenticated request to /api/v1/auto_login and receives a SUPERUSER token, then submits a malicious Python payload to /api/v1/validate/code, which executes it via exec() and yields a shell on the server. Given the network vector and low complexity (AV:N/AC:L/PR:N/UI:N), this requires no user interaction and can be fully scripted; no public exploit was identified at time of analysis, but the chain is straightforward to reproduce.