What is the CVSS score of CVE-2026-4503?

CVE-2026-4503 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of IBM Langflow Desktop are affected by CVE-2026-4503?

IBM Langflow Desktop versions 1.0.0 through 1.8.4 contain an unauthenticated vulnerability allowing attackers to enumerate and access private user-uploaded images through predictable object…. A patch is available.

How to fix or mitigate CVE-2026-4503?

Within 24 hours: Identify all IBM Langflow Desktop installations and document version numbers. Within 7 days: Upgrade all instances to version 1.8.5 or later (vendor-released patch). Implement network segmentation to restrict Langflow Desktop access to trusted networks only pending patch deployment. Within 30 days: Audit access logs for unauthorized image enumeration attempts; review retention policies for user-uploaded images to minimize exposure window.

IBM Langflow Desktop CVE-2026-4503

EUVD-2026-26435 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-30 ibm

Authentication Bypass IBM

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 21:45 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 21:15 euvd

EUVD-2026-26435

Analysis Generated

Apr 30, 2026 - 21:15 vuln.today

Patch released

Apr 30, 2026 - 21:15 nvd

Patch available

CVE Published

Apr 30, 2026 - 20:48 nvd

HIGH 7.5

DescriptionNVD

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.

AnalysisAI

Unauthenticated remote disclosure of user-uploaded images in IBM Langflow Desktop 1.0.0-1.8.4 allows network attackers to enumerate and access other users' private images through predictable object references. With CVSS 7.5 (High) reflecting unauthenticated network exploitation, and EPSS data not provided, risk depends on whether installations expose the vulnerable endpoint to untrusted networks. …

RemediationAI

Within 24 hours: Identify all IBM Langflow Desktop installations and document version numbers. Within 7 days: Upgrade all instances to version 1.8.5 or later (vendor-released patch). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-7524 CRITICAL Act Now

9.8 May 27

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitr

CVE-2026-8175 CRITICAL Act Now

9.8 May 27

Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Tra

CVE-2026-7876 CRITICAL Act Now

9.1 May 27

Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 throu

CVE-2026-5065 HIGH This Week

8.8 May 27

Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded

CVE-2026-8179 HIGH This Week

8.8 May 27

Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1)

CVE-2026-4503 vulnerability details – vuln.today

Back

IBM Langflow Desktop CVE-2026-4503

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

More from same product – last 7 days

Share

External POC / Exploit Code