CVE-2026-17630 affects IBM Langflow OSS versions 1.0.0 through 1.10.3 and stems from an incomplete list of disallowed inputs in configuration parameter validation (CWE-184). This flaw allows a remote attacker with high privileges to execute arbitrary code due to improper input validation. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, high confidentiality, integrity, and availability impact, and no user interaction required. The vendor has not provided a remediation level or patch information as of the publication date.

Successful exploitation could lead to remote code execution by an attacker with high privileges, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This poses a significant risk to systems running the affected versions of IBM Langflow OSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected software to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks.