What is the CVSS score of CVE-2026-12945?

CVE-2026-12945 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow are affected by CVE-2026-12945?

IBM Langflow OSS (versions 1.0.0-1.10.1) contains an authorization flaw that exposes sensitive AI workflow data and build configurations across user and tenant boundaries.. A patch is available.

How to fix or mitigate CVE-2026-12945?

Within 24 hours: identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.1 and document the scope of deployment and affected users. Within 7 days: apply the available vendor patch by upgrading to the fixed version per IBM's security advisory. Within 30 days: review access logs for the prior 90 days to audit for potential unauthorized cross-user access to build jobs and workflow data, and validate that authorization controls properly restrict user access.

IBM Langflow CVE-2026-12945

EUVD-2026-51242 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-30 ibm

GHSA-xxrp-rxf8-3mmx

Authentication Bypass IBM Langflow Oss

7.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network-reachable IDOR needing only a low-privileged account (PR:L) with no interaction; cross-user log exposure gives C:H, job tampering gives A:L, no integrity change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:22 vuln.today

CVE Published

Jul 30, 2026 - 16:44 nvd

HIGH 7.1

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

AnalysisAI

Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privileged user read and tamper with build jobs belonging to other users by abusing improper access control on log-retrieval and unauthenticated build endpoints. Because Langflow orchestrates LLM/agent workflow builds, a cross-tenant attacker can view sensitive build logs (high confidentiality impact) and interfere with others' jobs (limited availability impact). A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not on CISA KEV.

Technical ContextAI

Langflow OSS is IBM's open-source visual builder for LangChain-style AI/agent pipelines, where each 'build' compiles and runs a user's flow and produces logs. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. an IDOR): the log-retrieval and build endpoints key on a user-supplied job/build identifier without verifying that the requesting principal actually owns that job. The CPE cpe:2.3:a:ibm:langflow_oss:*:* confirms the affected component is the Langflow OSS application itself. One build endpoint is additionally described as unauthenticated, meaning the object-reference check - and in that path any authentication - is missing at the resource layer rather than being a session or credential flaw.

RemediationAI

Apply the fixed release referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7279994; the input confirms a vendor patch is available but does not state the exact fixed version, so treat the patched version as 'per vendor advisory' and confirm the target build directly from that page (the fix should be the release above 1.10.1). Until patched, restrict network reachability of the Langflow instance to trusted users and place it behind an authenticating reverse proxy or network ACL so the unauthenticated build endpoint cannot be reached anonymously - accepting that this blocks legitimate remote/API access. Additionally minimize the number of low-privileged accounts and, where feasible, isolate distinct users into separate Langflow instances to remove the cross-tenant object-reference exposure, at the cost of higher operational overhead. Monitor access logs for build/log-retrieval requests referencing job IDs the caller does not own.