CVE-2026-110192: Langflow OSS is affected by multiple vulnerabilities

Q: Who is exposed to this issue?

Deployments of IBM Langflow OSS versions 1.0.0 through 1.12.8 are affected. Exploitation requires remote authenticated access, so unauthenticated remote users are not identified as attackers in the available data.

Q: What could an attacker gain through exploitation?

An authenticated remote attacker could obtain sensitive information because credentials are insufficiently protected. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Published Oct 28, 2026

Updated

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

Other sources

Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

— IBM

Affected Software

1 affected component

IBM Langflow OSS<=1.0.0 - 1.12.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Langflow OSS to a version that resolves this vulnerability.
Fixed in 1.13.0

Event History

Oct 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 29, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294467

Frequently Asked Questions

Who is exposed to this issue?

Deployments of IBM Langflow OSS versions 1.0.0 through 1.12.8 are affected. Exploitation requires remote authenticated access, so unauthenticated remote users are not identified as attackers in the available data.

What could an attacker gain through exploitation?

An authenticated remote attacker could obtain sensitive information because credentials are insufficiently protected. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

CVE-2026-110192: Langflow OSS is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to this issue?

What could an attacker gain through exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What could an attacker gain through exploitation?