An authenticated user may send a single HTTP request to cancel any victim’s running background workflow job. The vulnerability bypasses the flow‑level permission check, causing a loss of in‑progress compute work without impacting data integrity. The primary impact is a denial of service to the victim’s workflow progress, which could result in wasted CPU resources and delayed completion of tasks.

IBM Langflow OSS versions 1.0.0 through 1.12.3 are affected. Users running these releases are vulnerable when authenticated to the application; the issue applies to all users who can trigger background jobs via the web interface.

The CVSS score of 6.5 indicates a moderate severity that can be exploited by an attacker who has authenticated access, which is typically an internal or compromised account. The EPSS score is not available, but the KEV list does not currently include this CVE, suggesting no widely known exploits at present. The attack path is straightforward: authenticated access to the application, followed by an HTTP request to the cancel endpoint. The risk is heightened where users have broad permissions to run and cancel jobs, as an attacker could repeatedly cancel critical background tasks.