Critical Langflow Flaws Allow Unauthenticated Code Execution
Four flaws in Langflow 1.0.0-1.12.8 enable unauthenticated RCE and auth bypass; upgrade to 1.13.0 fixes them.
75
Vulnerability1 · 1 read
CVE-2026-110192
Insufficiently Protected Credentials in Langflow OSS before 1.13.0
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
IBM Langflow OSS versions 1.0.0 through 1.12.8 exposes sensitive information due to insufficiently protected credentials. A remote authenticated attacker triggers the flaw over the network after logging in with valid credentials. They gain access to sensitive data. All users of affected versions are at risk.
What to do: Apply IBM's update for CVE-2026-110192. No workaround available.
| Product | Affected |
|---|---|
| IBM langflow | 1.0.0 through 1.12.8 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.