CVE-2026-12944 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability allows attackers with some privileges to execute arbitrary Python code as root (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This leads to multiple impacts including AWS credential theft via IMDSv1 SSRF with full IAM role permissions, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services such as PostgreSQL and Redis within the Docker network. Additionally, the vulnerability scanner incorrectly returns a "validated": true status, providing a false sense of security. The CVSS v3.1 score is 9.6, indicating critical severity. No patch or vendor advisory is provided in the data.

Successful exploitation allows attackers to execute arbitrary Python code with root privileges on the Langflow server. This enables theft of AWS credentials via SSRF attacks against IMDSv1 with full IAM role permissions, exfiltration of arbitrary files from the container filesystem, and lateral movement to internal services such as PostgreSQL and Redis within the Docker network. The vulnerability compromises confidentiality and integrity with high impact, but availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Langflow server and monitor for suspicious activity related to component submissions containing socket or urllib imports. Do not rely on the vulnerability scanner's "validated": true result as it provides a false security signal.