IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control flaw (CWE-284) that allows a remote authenticated attacker to execute arbitrary code. The vulnerability can lead to full compromise of the affected system, undermining confidentiality, integrity, and availability. No exploitation is described beyond the need for valid credentials, but the attacker can run arbitrary commands once authenticated due to the broken authorization checks.

The affected product is IBM Langflow OSS. All releases from 1.0.0 up to and including 1.12.2 are vulnerable; the issue is fixed in 1.12.3. No other IBM products or versions are listed as impacted.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is not reported, but the exploitability is not negligible given it requires remote authenticated access, which is common in typical operating environments. The vulnerability is not listed in CISA’s KEV catalog, but it can be exploited by any user who can obtain valid credentials or by exploiting default or weak accounts. The overall risk is high, especially for environments where Langflow OSS is exposed to external networks and user accounts are not tightly controlled.