A critical remote code execution vulnerability in IBM Langflow OSS allows unauthenticated attackers to execute arbitrary code, posing a severe risk to system integrity and confidentiality.

This vulnerability is a code injection flaw (CWE-94) originating from improper enforcement of security restrictions on the A2A public endpoint, which can be triggered by an unauthenticated attacker.

Successful exploitation grants an attacker the ability to execute arbitrary commands on the underlying host, leading to complete system compromise. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could result in unauthorized data access, lateral movement within the network, and significant operational disruption.

Immediate Action: Upgrade to IBM Langflow OSS version 1.11.2 immediately as specified in the official vendor advisory.

Proactive Monitoring: Review web server and application logs for suspicious requests directed at the A2A endpoint that deviate from standard operational traffic patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized or malicious payloads targeting the A2A endpoint until the patch can be applied.

Public Exploit Available: Unknown

This vulnerability carries a critical severity rating and requires immediate attention due to the potential for full remote system compromise. Organizations running affected versions of IBM Langflow OSS should prioritize the update to version 1.11.2 to eliminate the exposure and prevent potential exploitation.