IBM Langflow EUVD-2026-45282

Exploitation requires an authenticated session - the CVSS vector specifies PR:L, so the attacker must first hold a valid low-privilege Langflow OSS account (registration, stolen credential, or existing tenant user); it is not exploitable pre-authentication. Given that foothold, no user interaction (UI:N) and no special product configuration are needed - the traversal works against the affected file-handling endpoint over the network (AV:N) with low complexity (AC:L) on default deployments of Langflow OSS 1.0.0-1.10.0. The limiting factors defenders should weigh: the mandatory prior authentication, the requirement that the JWT signing key be present in a filesystem location reachable by traversal from the running process, and that the process account can read it; deployments that gate account creation and isolate secrets materially reduce realistic risk.

The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N: network-reachable, low attack complexity, low privileges required, no user interaction, high confidentiality and integrity impact, no availability impact. The PR:L requirement is the key limiter - an attacker must already hold some authenticated (even low-privilege) account, which is why this is not a wormable unauthenticated bug. That is reflected in the low EPSS (0.38%, 31st percentile), and there is no CISA KEV listing and no public exploit identified, so real-world exploitation is not currently observed. However, the signals are internally consistent and the practical impact is high: the C:H/I:H rating captures that arbitrary file read escalates directly to full authentication forgery and account takeover. Prioritize this above a typical 'high CVSS, low real risk' issue for any internet-exposed or multi-tenant Langflow deployment, since a single low-privilege credential yields admin impersonation. No key data appears conflicting; the main unknown is whether exploitation is trivially automatable post-authentication (SSVC 'automatable' not provided in input).

An attacker who has registered or obtained any low-privilege Langflow account sends a crafted request to a vulnerable file-handling endpoint containing path-traversal sequences to read the server's JWT signing key off disk. Using that key, they forge a JWT asserting an administrator identity and replay it to gain full control of the Langflow instance and its stored workflows and credentials. No public proof-of-concept is identified at this time, and the low complexity (AC:L) plus network vector (AV:N) mean the only real barrier is obtaining the initial low-privilege token.