CVE-2026-93678: Langflow OSS is affected by multiple vulnerabilities
Published Oct 2, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
Other sources
Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
— IBM
Affected Software
1 affected component
IBM Langflow OSS<=1.0.0-1.12.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.3
Event History
Oct 2, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 7, 2026
CVE Published
via MITRE·12:01 AM
Data Sourced
via MITRE·12:01 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an existing account or user interaction?
Yes. The CVSS vector indicates that an attacker needs low-level privileges, but no user interaction is required.
2
Can this be exploited remotely, and how difficult is exploitation?
The issue is network-accessible and has low attack complexity according to the CVSS vector.
3
What security impact is indicated beyond information disclosure?
The CVSS vector rates integrity impact as high and availability impact as low, in addition to low confidentiality impact.