CVE-2026-12944: IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0)

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability where attackers can run arbitrary Python code (code that does whatever the attacker wants) with root privileges (the highest access level) by uploading components that import socket or urllib libraries. This allows attackers to steal AWS credentials, steal files from the server, or attack other services like PostgreSQL and Redis running on the same network, while a faulty security check incorrectly marks these malicious components as safe.