{"id":"CVE-2026-107327","published":"2026-10-29T16:17:50.330","lastModified":"2026-10-30T04:18:01.257","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Missing authorization in IBM Langflow OSS versions 1.0.0 through 1.12.4 allows authenticated users to perform unauthorized actions, potentially leading to remote code execution.","exploitability":"Exploitation requires a low-privileged authenticated attacker with network access; no special conditions beyond valid credentials are needed.","blast_radius":"Successful exploitation could lead to full system compromise including data exfiltration, unauthorized modifications, and service disruption across the Langflow environment.","remediation":"Upgrade to IBM Langflow OSS version 1.12.5 or later, which includes the fix for the missing authorization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rce","web","api"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:11:31.472Z"}}