IBM Langflow OSS EUVD-2026-71598

Exploitation requires a valid authenticated session on the IBM Langflow OSS instance - any low-privilege account suffices per the PR:L CVSS metric. The attack specifically targets the flow build process, meaning the attacker must be able to submit flow build requests to the server. No non-default configuration, specific feature enablement, or privileged role is described as a prerequisite beyond basic authenticated access to Langflow. Exploitation is bounded by the requirement for prior authentication; unauthenticated network attackers cannot directly exploit this flaw without first obtaining credentials.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat profile: network-reachable, low complexity, requiring only a low-privilege account, and delivering full triad impact. No EPSS score was provided, so exploitation probability cannot be quantified; absent KEV status and public POC, the immediate opportunistic risk is lower than a KEV-listed critical, but the attack is simple enough that even a mid-sized municipal IT team in legnica running Langflow for internal AI workflows should treat this as urgent - any authenticated user, including contractors or low-trust service accounts, can escalate to arbitrary code execution with no further prerequisites. Langflow deployments are particularly high-value targets because flows routinely embed API keys, database credentials, and connections to sensitive data sources; code execution on the Langflow server therefore typically implies secondary access to those assets. The authorization bypass in the build process is architecturally significant: it means the platform's intended trust boundary between user roles is not enforced. No conflicting signals between CVSS and description were identified.

An attacker holding any valid low-privilege Langflow account - for example a contractor account or a compromised internal user - crafts a flow build payload that bypasses the server-side authorization check, injecting executable code into the build process. Because attack complexity is low and no user interaction is required, the attack is straightforward to execute once credentials are in hand. The Langflow server executes the injected code in its runtime context, giving the attacker access to the server environment, embedded secrets, and all data sources connected to the platform.