What is the CVSS score of CVE-2026-101329?

CVE-2026-101329 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-101329?

Yes, a patch is available for CVE-2026-101329. Update the affected software to the latest version immediately.

IBM Langflow OSS CVE-2026-101329

EUVD-2026-94128 MEDIUM

Improper Access Control (CWE-284)

2026-10-06 ibm

GHSA-pc86-f397-xcjj

Authentication Bypass IBM Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with low complexity and no user interaction; PR:L because valid authentication is required per CWE-284 improper access control; C:H with I:N/A:N as only sensitive data is disclosed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 00:51 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.

AnalysisAI

Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to already hold valid authenticated credentials on an IBM Langflow OSS instance (version 1.0.0 through 1.12.2), consistent with PR:L - even a low-privilege account suffices. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-severity information disclosure (CVSS 6.5) rated by IBM with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable, low attack complexity, but requiring low-level authentication (PR:L) and yielding high confidentiality impact with no integrity or availability effect, consistent with CWE-284 improper access control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch status is 'Patch available per vendor advisory': IBM has published a fix through IBM Support node 7290694 (https://www.ibm.com/support/pages/node/7290694), and the exact patched version string should be taken from that advisory rather than assumed, since the provided data does not specify a minimum fixed release - operators running 1.0.0 through 1.12.2 should upgrade to the version IBM designates as fixed before exposing the instance further. … Detailed patch versions, workarounds, and compensating controls in full report.