Hard-coded credentials in IBM Langflow OSS (CVE-2026-13446)

IBM Langflow OSS contains hard-coded credentials (such as a password or cryptographic key) used for inbound authentication, outbound communication to external components, or encryption of internal data. Specifically, hardcoded default superuser credentials are enforced at startup regardless of operator-supplied environment variable overrides, allowing an unauthenticated attacker to authenticate as a superuser without prior knowledge of configured secrets. This vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with full confidentiality, integrity, and availability impact over the network without authentication or user interaction. Affected versions: - 1.0.0-1.10.1 We recommend updating to: 1.10.2. CVSS 9.8 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7279991 Details: https://vuln.today/cve/CVE-2026-13446