IBM Langflow OSS EUVD-2026-75801

The attacker must hold an authenticated low-privilege account on the IBM Langflow OSS instance (PR:L) with permission to submit custom component source code - this is the core limiting condition. The crafted component must also be triggered along the runtime execution path (i.e., incorporated into an active workflow and executed), not merely uploaded. Affected versions are 1.0.0 through 1.11.5 running the IBM Langflow OSS distribution. Exploitation is limited to deployments where user-submitted components are permitted; installations where component submission is restricted to administrators or where no custom components are used are not reachable via this path. No special network positioning is required beyond authenticated access to the Langflow web interface.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-grounded. The attack is network-accessible and requires no user interaction after component submission, but PR:L correctly reflects that the attacker must hold an account with component-submission privileges - this is not an unauthenticated path. For multi-tenant or shared Langflow deployments (e.g., internal AI development platforms), any low-privilege user becomes a lateral movement risk to the host OS. EPSS data was not provided in the source intelligence, and the vulnerability is not listed in CISA KEV, so no confirmed active exploitation is known. No public proof-of-concept has been identified. Exploitation requires knowing the specific annotated class-body pattern that evades alias tracking - a non-trivial but one-time research effort that would be quickly commoditized once disclosed. The key limiting factor is the PR:L requirement: environments that restrict who can submit components (e.g., single-user or admin-only deployments) face substantially lower real-world risk than collaborative or SaaS-style instances.

An authenticated Langflow user with component-submission access crafts a Python component that uses an annotated class-body assignment (e.g., cmd: Callable = os.system) to reference a dangerous OS callable through alias indirection. The static scanner resolves the alias but fails to check the resolved callable against the blocklist, so the component passes security validation. When the component is executed as part of a workflow, the Langflow service executes arbitrary OS commands with its own process privileges, enabling full host compromise. No public proof-of-concept has been identified at time of analysis.