IBM Langflow OSS EUVD-2026-75796

The attacker must hold a valid low-privilege account on the target IBM Langflow OSS instance (CVSS PR:L confirmed). The MCP stdio server configuration interface must be accessible to that authenticated user - if access to this feature is restricted to administrators only by configuration, low-privilege users cannot reach the vulnerable code path. No victim user interaction is required (UI:N), and no special network position or timing is needed (AV:N, AC:L). Unauthenticated attackers cannot exploit this vulnerability. The flaw is scoped to the MCP stdio server argument handling; other Langflow components are not directly implicated by this CVE.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a high-severity but authenticated-only flaw. The critical mitigating factor relative to a 9.8 unauthenticated score is PR:L - the attacker must hold a valid account. AC:L and UI:N mean no special timing, race condition, or victim interaction is needed beyond authentication. Scope:Unchanged (S:U) limits the blast radius to the application's own OS context rather than a hypervisor or neighboring tenant. No EPSS score is provided in the input data; no KEV listing and no POC are referenced, so no public exploit has been identified at time of analysis. Real-world risk is highest in SaaS or shared Langflow deployments where untrusted or external users hold accounts - a single compromised credential is sufficient to pivot to OS-level code execution on the server. Organizations running Langflow with a closed, trusted user base face materially lower risk. Patch availability reduces urgency for well-monitored environments.

An authenticated low-privilege user of a shared IBM Langflow OSS instance navigates to the MCP stdio server configuration and injects OS command metacharacters (e.g., a semicolon followed by a reverse-shell payload) into a command-line argument field. Upon saving or activating the configuration, the server spawns an OS subprocess incorporating the injected command, achieving arbitrary code execution under the process account running Langflow. No public exploit code has been identified at time of analysis.