What is the CVSS score of CVE-2026-13444?

CVE-2026-13444 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by CVE-2026-13444?

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a cross-tenant data access vulnerability enabling authenticated users to read and modify other users' private documents without authorization.. A patch is available.

How to fix or mitigate CVE-2026-13444?

Within 24 hours: Locate all IBM Langflow OSS deployments running versions 1.0.0-1.10.1 in your infrastructure and classify by data sensitivity and user count. Within 7 days: Apply vendor patch to all affected instances and review authentication logs for cross-user document access patterns that may indicate exploitation of this vulnerability. Within 30 days: Complete a full audit of Chroma collections for unauthorized document modifications, rotate credentials for affected systems, update access control policies to restrict cross-flow document sharing, and deploy monitoring for suspicious cross-tenant data access attempts.

IBM Langflow OSS CVE-2026-13444

EUVD-2026-51272 HIGH

.NET Misconfiguration: Use of Impersonation (CWE-520)

2026-07-30 ibm

GHSA-vrqm-44rp-59j5

Information Disclosure IBM Langflow Oss

8.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Authenticated low-priv network access (PR:L) with low complexity yields high confidentiality (reading private docs) and high integrity (collection pollution); no availability impact and scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:39 vuln.today

CVE Published

Jul 30, 2026 - 18:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 18:38 cve.org

HIGH 8.1

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

AnalysisAI

Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the CVSS 8.1 rating reflects the combined high confidentiality and integrity impact.

Technical ContextAI

Langflow is an open-source visual/low-code framework for building LLM and retrieval-augmented-generation (RAG) pipelines, where Chroma is a commonly used embedded vector database. Chroma persists collections to a local path defined by persist_directory and identifies logical document sets by collection_name. In affected Langflow versions those two values act as a shared global namespace: any flow specifying matching values binds to the same underlying Chroma store regardless of which user owns the original flow. Because Langflow does not scope Chroma access to the owning user or flow, isolation between tenants collapses. This maps to CWE-520 (misconfiguration/failure to enforce the intended security boundary), with the practical root cause being missing per-user access control on a shared storage namespace rather than any memory-safety defect.

RemediationAI

Patch available per vendor advisory: upgrade IBM Langflow OSS to the fixed release described in IBM's advisory at https://www.ibm.com/support/pages/node/7279989 (no exact fixed version number is stated in the provided data, so confirm the target version directly from that advisory). Until patched, avoid sharing or reusing Chroma persist_directory and collection_name values across users, and assign each user or flow a unique, non-guessable collection_name and an isolated persist_directory path so distinct tenants cannot bind to the same store; the trade-off is added configuration overhead and loss of any intentional cross-flow collection sharing. In multi-tenant or hosted environments, restrict who can create or edit flows and consider isolating each tenant's Langflow instance and Chroma storage at the filesystem or container level, accepting the higher operational cost of per-tenant isolation.