IBM Langflow OSS EUVD-2026-75792

Exploitation requires a valid authenticated account on the IBM Langflow OSS instance with at minimum low-privilege access (CVSS PR:L). The attacker must be able to submit workflow inputs, component configurations, or execution parameters that reference environment variables - a normal interaction pattern within Langflow's intended use. No user interaction beyond the attacker's own authenticated session is required (UI:N), and no special non-default configuration of Langflow is needed beyond running an affected version (1.0.0-1.11.5). Limiting factors: the attacker must possess valid credentials for the specific target instance; the exact environment variables exploitable depend on which entries are missing from the blocklist (specific variables not publicly enumerated at time of analysis); and the platform must be reachable over the network by the attacker. Instances with strict access controls limiting who can create or execute workflow components have a meaningfully reduced attack surface.

The CVSS 8.8 score accurately reflects the post-authentication severity: the attack is network-accessible, low-complexity, and requires only low-privilege credentials before achieving full C:H/I:H/A:H impact. The primary real-world limiting factor is PR:L - exploitation is constrained to authenticated users rather than anonymous internet actors, meaningfully reducing exposure compared to a PR:N vulnerability of equivalent impact. No EPSS data, CISA KEV listing, or public POC is present in the available intelligence, indicating no confirmed active exploitation at time of analysis. However, the AI/ML pipeline execution context of Langflow makes code injection particularly dangerous: the platform is designed to run user-supplied logic, which complicates behavioral detection and allows the injected payload to blend with legitimate workflow activity. Any organization running a multi-user Langflow OSS deployment - even a mid-sized municipal IT team in bytom piloting AI automation - should treat this as urgent, given the low post-authentication barrier and the high likelihood that attacker-controlled workflow inputs are a common interaction pattern. The incomplete blocklist root cause also raises a concern that the patch scope may need independent verification: blocklist-based mitigations are prone to future bypasses if the fix only adds specific entries rather than restructuring the restriction approach.

An attacker with a valid low-privilege account on an IBM Langflow OSS instance (versions 1.0.0-1.11.5) constructs a workflow component or execution payload that references an environment variable absent from the server's incomplete blocklist, injecting malicious code into the platform's execution context. The server evaluates the injected code with application-level privileges, granting the attacker full control over the host. No public exploit code has been identified at time of analysis, but given low attack complexity (AC:L) the technique is straightforward to replicate once a working account is obtained.