IBM Langflow OSS EUVD-2026-75799

Exploitation requires a valid authenticated session with at least low-privilege access to the IBM Langflow OSS instance (PR:L per CVSS vector). The attacker must be able to supply input to the code path containing the unguarded eval() - most likely through workflow node configuration, expression fields, or a custom component definition within the Langflow UI or API. No user interaction from a victim is required (UI:N). Exploitation is limited by: (1) requirement for a valid account - prevents fully unauthenticated external attacks; (2) the Langflow instance must be network-reachable from the attacker (AV:N satisfied only if the service is exposed); (3) affected versions are 1.0.0 through 1.11.5 - patched deployments are not affected. Deployments restricted to internal networks with tightly controlled account provisioning have materially reduced exposure.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the primary risk factors: the attack is fully network-reachable, requires no complexity, demands only a low-privilege account, and yields full confidentiality/integrity/availability impact on the host running the Langflow service. The scope is unchanged (S:U), indicating the exploit does not inherently escape to adjacent systems, though code execution on an AI orchestration server typically grants access to API keys, model endpoints, and downstream datastores. EPSS data is not provided; no KEV listing exists and no public POC has been identified, so real-world exploitation likelihood is currently unconfirmed. The primary risk amplifier is deployment context: Langflow instances that are internet-exposed and allow self-registration (or where attacker-controlled accounts can be provisioned) elevate this from an insider/post-auth threat to a near-external one. Organizations running Langflow behind strict access control with audited accounts face materially lower near-term risk. No conflicting signals are present in the available data.

An attacker with a valid low-privilege Langflow account (e.g., a shared workspace member or a self-registered user on a public-facing deployment) crafts a workflow node or expression input that embeds Python commands - such as subprocess calls - in the value passed to the unguarded eval(). Upon executing the workflow or triggering the evaluation endpoint, the server executes the injected code under the Langflow process identity, granting full access to the host filesystem, environment variables (including API keys and model credentials), and internal network resources. No public exploit code has been identified at time of analysis, but the technique is well-understood and trivially constructed against any unguarded eval().