Langflow OSS EUVD-2026-94105

Exploitation requires a valid authenticated account on the target Langflow OSS instance (CVSS PR:L), with the instance reachable over the network (AV:N); no user interaction is needed. The affected versions are Langflow OSS 1.0.0 through 1.12.2, so deployments outside this range are not impacted. The limiting factor is the authentication requirement: an attacker must first obtain low-privilege credentials, which is realistic where Langflow exposes open/self-service registration, shared accounts, or is internet-facing without network restrictions, but is a meaningful barrier in locked-down, network-segmented, SSO-gated deployments. The precise feature or endpoint abused via the improper access control is not specified in the available data.

This is a genuine high-priority issue for organizations running IBM Langflow OSS. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw that requires only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability loss - consistent with remote code execution. CWE-284 (Improper Access Control) plus the RCE outcome indicates an authenticated user can perform actions beyond their intended authorization. No EPSS probability, no CISA KEV entry, and no public POC are present in the input, so predicted and observed exploitation activity is currently unknown rather than confirmed low - absence of these signals is not evidence of safety. Net: a high-impact, low-barrier flaw in a product that exposes code-execution surface by design; treat as a real patch priority, but note that exploitation-likelihood signals (EPSS/KEV/POC) are entirely missing from the data and should be monitored rather than assumed. One caveat to verify: the 'Authentication Bypass' tag conflicts with the PR:L vector and 'remote authenticated attacker' wording, which describe post-authentication abuse, not a bypass.

An attacker who already holds valid low-privilege credentials to a Langflow instance (e.g., a self-registered or shared tenant account) sends crafted requests that exploit the improper access control to reach functionality that executes code on the server. Because Langflow natively runs user-defined Python components and flows, abusing the authorization gap converts a limited account into full server code execution. No public exploit code is identified at time of analysis, and no user interaction is required.