CVE-2026-77817: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
Other sources
Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.5 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS 1.12.5.
Event History
Frequently Asked Questions
Is authentication required to exploit this issue?
Yes. The issue is described as exploitable by a remote authenticated attacker.
Which operations may expose sensitive information?
Flow and project exports are affected because secrets may not be properly sanitized during those exports.