IBM Langflow OSS EUVD-2026-75778

No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any network-accessible instance of IBM Langflow OSS 1.0.0-1.11.5. Exploitation impact is bounded by what internal or cloud-adjacent services are reachable from the Langflow host: deployments without cloud metadata service access or internal API exposure will see limited confidentiality impact despite the high CVSS C:H rating. Exploitation is limited to confidentiality (read access) with no integrity or availability impact based on the CVSS vector.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible, zero-authentication SSRF with high confidentiality impact. The low attack complexity and absence of required privileges or user interaction make this automatable at scale - any internet-exposed Langflow instance is potentially in scope. Real-world risk is highly deployment-sensitive: instances running in cloud environments (AWS, Azure, GCP) with accessible metadata services face significantly elevated risk because successful SSRF can harvest IAM role credentials, enabling privilege escalation beyond the Langflow instance. Instances running air-gapped or behind authenticated proxies have substantially reduced exposure. EPSS data is not provided; no KEV listing and no public POC further temper immediate threat urgency, though AI orchestration platforms are increasingly targeted by automated scanning. The absence of integrity and availability impact in the CVSS vector is consistent with typical SSRF read-only behavior.

An unauthenticated attacker sends a crafted HTTP request to an internet-exposed IBM Langflow OSS instance, supplying a URL pointing to the AWS instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The Langflow server fetches the URL on the attacker's behalf and returns or leaks the response, exposing IAM role credentials that the attacker then uses to authenticate directly to AWS APIs. No public exploit code has been identified, but the technique is well-documented for SSRF against cloud-hosted services.