CVE-2026-110200: Langflow OSS is affected by multiple vulnerabilities
Published Oct 19, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.
Other sources
Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.
— IBM
Affected Software
2 affected components
IBM Langflow OSS<=1.0.0 - 1.12.4
Langflow Langflow>=1.0.0<1.12.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.5 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.5.
Event History
Sep 25, 2026
Exploit Published
via GitHub·08:52 PM
Oct 19, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 29, 2026
CVE Published
via MITRE·03:15 PM
Data Sourced
via MITRE·03:15 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·04:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Can an unauthenticated attacker exploit this issue?
The issue is described as requiring remote authenticated access. An attacker would need valid authentication before attempting to obtain the affected sensitive information.