What is the CVSS score of EUVD-2026-75771?

EUVD-2026-75771 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-75771?

Within 24 hours, identify all systems running IBM Langflow OSS 1.0.0-1.11.5 and restrict access to essential administrative accounts only; review authentication logs for any suspicious activity. Within 7 days, apply the vendor-released patch to all affected instances and test in a staging environment before production deployment; confirm version upgrade is successful. Within 30 days, conduct a forensic audit of access logs and system activity during the vulnerability window to determine if exploitation occurred, and implement network segmentation to limit Langflow's access to sensitive data sources.

IBM Langflow OSS EUVD-2026-75771

| CVE-2026-81940 HIGH

Code Injection (CWE-94)

2026-09-10 ibm

GHSA-c28j-rh28-j7f7

RCE IBM Code Injection Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privilege Langflow user
Delivery

Create or edit flow with malicious display name
Exploit

Server evaluates display name in code-generation context
Execution

Injected payload executes server-side
Impact

Full host compromise (C:H/I:H/A:H)

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a valid authenticated session with at least low-privilege access to the IBM Langflow OSS web interface (PR:L per CVSS vector). The attacker must have permission to create or modify flows and set their display names - a capability available to any standard registered Langflow user, not restricted to administrators. No special non-default deployment configuration, additional software, or pre-positioned access is required beyond basic authentication. Exploitation is bounded by the authentication requirement; unauthenticated external attackers or users without flow-creation permissions cannot directly trigger this vulnerability. The flaw is present across a broad version span (1.0.0-1.11.5), maximizing the population of vulnerable deployments that have not yet patched.
Impact	The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity but access-gated vulnerability: any authenticated user, including those with only basic privileges, can exploit this remotely with no special configuration and no user interaction. The unchanged scope (S:U) limits blast radius to the Langflow host itself, but full C:H/I:H/A:H on that host represents complete system compromise. No EPSS data is available in the provided intelligence, and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at the time of this analysis. However, the low exploitation complexity (AC:L, PR:L) means that even a mid-sized municipal IT team in sanok should treat this as urgent if Langflow is accessible to any non-fully-trusted internal user. This CVE also joins CVE-2026-81941 as a second independently reported RCE path in IBM Langflow OSS, suggesting a broader pattern of insufficient input handling across the platform that elevates the collective risk profile.
Exploit ScenarioDerived	An authenticated Langflow user with default low privileges creates a new flow and sets its display name to a string containing code injection characters (for example, Python template metacharacters or escape sequences). When the application processes this display name in a downstream code-generation or evaluation step, the injected payload executes server-side with the privileges of the Langflow process, granting the attacker full control over the host.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 10, 2026

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows any authenticated low-privileged user to inject and execute arbitrary server-side code by embedding special characters in flow display names. The root cause is inadequate neutralization of user-controlled input before it enters a code-generation or evaluation context (CWE-94), yielding full host compromise across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.

RemediationAI

Apply the vendor-supplied patch per the IBM advisory at https://www.ibm.com/support/pages/node/7286666 - the exact fixed version number is not independently confirmed from the available input data and must be verified directly with the advisory. As compensating controls prior to patching, restrict access to the Langflow interface to only fully trusted authenticated users via network-layer enforcement (firewall rules, VPN or allowlist gating), since the vulnerability requires at least low-privilege authenticated access. Additionally, consider auditing existing flow display names for anomalous special characters or injection patterns. Limiting flow-creation and flow-edit permissions to a minimal set of trusted operators reduces the attack surface at the cost of reduced collaborative access to the platform.

Affected VersionsENISA

Langflow OSS 1.0.0 ≤1.11.5

Affected Packages

euvd langflow_oss no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

IBM Langflow OSS is a visual, open-source framework for constructing and executing LLM-based AI pipelines. Flows are the core unit of work, and their metadata - including display names - is user-controlled. The vulnerability (CWE-94: Improper Control of Generation of Code) arises because flow display names are passed into a code-generation or dynamic evaluation context without stripping or escaping dangerous special characters, allowing injected payload fragments to be interpreted and executed as code. The affected CPE (cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*) covers all versions from 1.0.0 through 1.11.5. This is consistent with Langflow's architecture, which heavily uses Python-based dynamic execution for flow components.

Know when Langflow Oss gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (ibm) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-accessible interface requires only low-privilege authentication; flow name injection achieves full system compromise with no additional conditions or user interaction.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

Executive ViewAI

Why It Matters

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a code injection flaw that allows any authenticated user-including those with minimal privileges-to execute arbitrary server-side commands and achieve complete host compromise. Organizations running Langflow in production face risk of data exfiltration, system takeover, and lateral movement if internal or supply-chain users exploit this vulnerability.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 56% exploitable

Prevalence

Low

niche AI workflow framework, limited enterprise production footprint

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.