CVE-2026-17630 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. The vulnerability arises from an incomplete list of disallowed inputs in configuration parameter validation, allowing a remote attacker with high privileges to execute arbitrary code. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, high privileges, no user interaction, and results in high confidentiality, integrity, and availability impacts. No known exploits are reported in the wild, and no official fix or mitigation has been disclosed by IBM at this time.

Successful exploitation could lead to arbitrary code execution by a remote attacker with high privileges, potentially compromising confidentiality, integrity, and availability of the affected system. This could allow the attacker to fully control the affected IBM Langflow OSS instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to trusted users with high privileges and monitor for suspicious activity related to configuration parameter changes.