Brute force authentication bypass in IBM Langflow OSS (CVE-2026-19297)

IBM Langflow OSS contains a rate-limiting control on the login endpoint that can be explicitly disabled by an administrator or left unvalidated post-deployment. When disabled, a remote unauthenticated attacker can submit unlimited credential guesses against the login endpoint, enabling brute force or credential stuffing attacks that may result in full account compromise, including superuser access. Affected versions: - 1.0.0-1.9.6 We recommend updating to: 1.10.0. CVSS 9.1 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7283558 Details: https://vuln.today/cve/CVE-2026-19297