CVE-2026-12944
CRITICAL · 9.6Fresh CRITICAL vuln, rapid community triage, no PoC/KEV yet; elevated real-world risk without confirmed active exploitation.
What: IBM Langflow OSS 1.0.0–1.10.0 allows unauthenticated arbitrary Python code execution as root via socket/urllib imports in components, enabling credential theft, file exfiltration, and lateral movement. CVSS 9.6 CRITICAL.
Why it matters: Published yesterday; affects widely-used open-source LLM orchestration tool. NVD confirms root RCE with AWS IMDSv1 SSRF chain and container escape potential. No KEV-listing yet, but CRITICAL CVSS and immediate patch urgency signal real exposure in deployed instances.
Where it's seen: Bluesky infosec community amplifying NVD data and threat intel aggregators (Radar, HackerWire, StackFlag) within 24 hours of publication. No public PoC or in-the-wild exploitation reported; chatter is advisory-driven awareness-raising.
RISK: CRITICAL — Root RCE, AWS credential exposure, container-native attack chain affecting cloud-native deployments.
Description
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N- Attack vector
- Network
- Complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None