IBM Langflow OSS EUVD-2026-67955

No special conditions required for network-level access - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against IBM Langflow OSS 1.0.0 through 1.11.1 without any prerequisite configuration. Exploitation is limited by the attacker's ability to resolve or predict a valid victim user identifier; the degree of difficulty depends on whether identifiers are sequential, guessable, or derived from observable inputs. Exploitation scope is bounded to information disclosure and message injection - the integrity impact is limited (I:L) and availability is unaffected (A:N). Deployments isolated from public internet access have a materially reduced attack surface, though this is not a configuration-dependent prerequisite for the vulnerability itself.

The CVSS 3.1 score of 8.2 (High) is driven by a fully unauthenticated, low-complexity, network-accessible attack path with high confidentiality impact - a genuinely severe profile. EPSS data was not provided, and the absence of both a KEV listing and known public exploit code tempers urgency relative to the raw score. The lack of required privileges (PR:N) and user interaction (UI:N) means any internet-exposed Langflow OSS deployment is a viable target without preconditions. The integrity impact is limited to message injection rather than full data manipulation, which moderates the overall blast radius. A mid-sized enterprise IT team running AI workflow infrastructure in gdynia - or anywhere else - should treat this as a high-priority patch given the unauthenticated exposure and the sensitivity of LLM pipeline data. The primary unknown is whether default deployment configurations expose the vulnerable namespace endpoint to the internet or restrict it behind internal network controls; organizations should verify their exposure before relying on network perimeter as a mitigating factor.

An unauthenticated remote attacker sends crafted API requests to an internet-exposed IBM Langflow OSS instance, constructing or guessing a user identifier that collides with a legitimate user's namespace. The collision grants the attacker read access to that user's workflow data, conversation history, or pipeline outputs, and allows injection of unauthorized messages into their active sessions. No public exploit code has been identified at time of analysis, but the low attack complexity suggests exploit development would be straightforward for a motivated researcher.