IBM Langflow OSS EUVD-2026-75777

Exploitation requires the attacker to possess a valid Langflow API key that was issued while their account was active and that has not been manually revoked after account deactivation. The platform must be network-accessible with the API endpoint reachable by the attacker. Exploitation is strictly limited to individuals who previously held a legitimate account - former employees, contractors, or individuals who have obtained an API key through credential theft or account compromise; completely external unauthenticated attackers without a prior API key cannot exploit this vulnerability. No non-default configuration is required beyond standard multi-user API key usage, which is the normal operating mode of Langflow OSS deployments.

The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a realistic and credible threat model: any user who possesses a previously issued API key retains full workflow execution capability after being offboarded, with no additional technical effort required. The low attack complexity and network-accessible vector mean that even a mid-sized municipal IT team in mielec should treat this as urgent if they have recently offboarded Langflow users without explicit key revocation. No EPSS data, KEV status, POC code, or SSVC decision data are provided in the input, which limits exploitation probability estimation - the absence of KEV suggests mass exploitation has not been observed. However, the insider-threat and offboarding-failure scenarios are highly credible and require no technical sophistication beyond possession of a previously legitimate API key. The I:H rating is particularly notable: Langflow workflow execution typically involves reading and writing connected data sources, meaning the integrity impact is substantive and not merely theoretical.

A departing employee retains their Langflow API key after an administrator deactivates their account. Using standard HTTP tooling, they remotely submit authenticated API requests to execute existing workflows - accessing connected databases, extracting sensitive AI pipeline outputs, or injecting malicious logic into shared flows - with no indication to defenders that the underlying account was supposed to be inactive. No POC has been identified, but the attack requires only a previously issued API key and does not require any vulnerability research or exploit development.