CVE-2026-110192

Langflow OSS is affected by multiple vulnerabilities

No known exploitation. EPSS puts it in the 16th percentile. Fixed in 1.13.0.

CVSS 3.16.5Medium EPSS percentile16th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.13.0Upgrade to this build

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-10-29Updated 2026-11-04Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

IBM Langflow OSSAffected: ≥ 1.0.0, ≤ 1.12.8Upgrade to: after 1.12.8Stated by: CVE record
LangflowAffected: ≥ 1.0.0, < 1.13.0Upgrade to: 1.13.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you're running Langflow OSS version 1.0.0 through 1.12.8.
If deployed via pip, run: pip install langflow --upgrade.
If deployed via Docker, pull the updated image for version 1.13.0 or later.
Confirm the upgrade by checking the running version matches 1.13.0 or newer.
Review who has user accounts on your Langflow instance, since this issue requires a valid login to exploit.

pip install langflow --upgrade

Vendor advisory Usually a quick update

What it is

From the CVE record

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

In plain language

Written by AI from the record

If you run Langflow OSS for building AI workflows, a logged-in user could see credentials they shouldn't — update to version 1.13.0 when convenient, but there's no sign anyone is exploiting this.

CWE-522 (insufficiently protected credentials) in Langflow OSS versions 1.0.0–1.12.8 allows a remote authenticated, low-privilege user to retrieve sensitive credential data without impacting integrity or availability.

If you're affected

Credential/secrets exposure
Internal data leakage
Insider-access abuse risk

What is it

Langflow is a tool businesses use to build AI-powered workflows. This flaw is like a filing cabinet where any employee with a basic office key could open a drawer meant to be locked, and see sensitive passwords or keys stored inside. It doesn't let outsiders in on its own — someone first needs a valid login.

Who is affected

This matters to you if you self-host or manage Langflow OSS for building AI workflows or automations. It's relevant only if multiple people have accounts on your instance, since the person viewing the exposed credentials must already be logged in.

How urgent is it

This is a low-urgency issue: there's no confirmed exploitation in the wild, no entry on the government's actively-exploited list, and no public exploit code available. It's safe to schedule the upgrade as routine maintenance rather than an emergency.

What to do — in detail

Confirm your deployed Langflow OSS version is between 1.0.0 and 1.12.8 inclusive. Upgrade to 1.13.0 or later — via pip (pip install langflow --upgrade) or by pulling the updated Docker image from https://github.com/langflow-ai/langflow/releases. There is no documented workaround short of upgrading; in the interim, restrict user accounts to trusted personnel and audit who has access, since exploitation requires an authenticated session. No CISA KEV due date applies as this is not in the KEV catalog. Monitor the Langflow release notes and the IBM support page (https://www.ibm.com/support/pages/node/7294467) for further advisories.

Technical context

CVSS 3.1 score 6.5 (Medium), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N — network-exploitable, low complexity, requires low-privilege authentication, no user interaction, high confidentiality impact only. Weakness class CWE-522 (insufficiently protected credentials). Not listed in CISA KEV; no public exploit code known; EPSS places predicted exploitation likelihood in the low range with a flat trend. Exploit maturity is theoretical/unproven at this time.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS16th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 16th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 6 days, from the signal feeds we watch.

2026-11-04Patch availablerecord updated
2026-10-30Patch availablerecord updated
2026-10-29Patch availablepatch available, published, weakness classified, att&ck mapped, record updated

Affected products

IBMcommercial · USaka international business machines
- Langflow OSSOn-premOSS Libraries / generic-library
langflowcommercialaka langflow-base, langflow desktop
- langflowSaaSAI / ML / ai-agent-tooling

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact