IBM Langflow EUVD-2026-45285

Exploitation requires (1) network access to the Langflow OSS application and (2) an authenticated account with at least low privileges (CVSS PR:L), specifically the ability to create or modify an MCP server configuration file/definition - that MCP configuration path is the exact feature whose validation is incompletely enforced. It is limited to IBM Langflow OSS versions 1.0.0 through 1.10.0. Limiting factors: it is NOT unauthenticated (the attacker must be able to log in or hold a valid API credential), and it is only reachable where the MCP server configuration functionality is exposed to that user; deployments that gate MCP server management behind admin-only roles or that front Langflow with strong auth substantially reduce the exposed population.

This is a genuine priority for anyone running an exposed or multi-user Langflow instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - consistent with RCE via a config path reachable by an ordinary authenticated user. The scope-unchanged (S:U) rating plus PR:L means the practical bar is 'have any account/API access on the Langflow app,' which is realistic given Langflow deployments are frequently stood up with weak or no authentication in front of them. No EPSS score, SSVC decision, or KEV entry was provided, so exploitation probability cannot be quantified from this data; the absence of a KEV listing and of a known POC suggests it is not yet under mass exploitation, but the low attack complexity makes weaponization straightforward once details circulate. No conflicting signals were found - the network vector and low-privilege requirement align with a config-injection RCE.

An attacker with a low-privileged account on an internet- or intranet-reachable Langflow instance submits or edits an MCP server configuration containing a malicious command definition; because validation is incompletely enforced, Langflow spawns the attacker's command and executes arbitrary code on the host. Given AV:N/AC:L, this can be driven remotely with a single crafted API request and no user interaction. No public exploit code has been identified at time of analysis.