What is the CVSS score of CVE-2026-9103?

CVE-2026-9103 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow are affected by CVE-2026-9103?

IBM Langflow OSS versions 1.0.0-1.10.0 contain a critical authentication bypass (CVSS 9.8) allowing unauthenticated remote attackers to obtain superuser tokens and assume complete administrative…. A patch is available.

How to fix or mitigate CVE-2026-9103?

Within 24 hours, inventory all IBM Langflow OSS deployments, identify affected versions (1.0.0-1.10.0), and determine AUTO_LOGIN status; flag all production instances for emergency remediation. Within 7 days, apply the vendor-released patch to all systems, or if patching cannot proceed immediately, disable AUTO_LOGIN and restrict CORS policies to trusted origins. Within 30 days, complete patching across all deployments, audit /api/v1/login/auto_login access logs for unauthorized token generation, and execute a full token revocation cycle to invalidate any potentially compromised tokens.

IBM Langflow CVE-2026-9103

EUVD-2026-45258 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-17 ibm

GHSA-88m4-9v35-3pc9

Authentication Bypass IBM Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Default-enabled endpoint returns a superuser token to any unauthenticated network client in one request (AV:N/AC:L/PR:N/UI:N), yielding full admin compromise of the instance (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:19 vuln.today

CVE Published

Jul 17, 2026 - 18:49 cve.org

CRITICAL 9.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.

AnalysisAI

Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-lived superuser bearer token from the /api/v1/login/auto_login endpoint whenever the AUTO_LOGIN setting is on - which is the default. Because the endpoint mints full-admin tokens with no credentials, any network-reachable attacker gains complete administrative control, and overly permissive CORS can leak those tokens to unintended origins. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Langflow is an open-source, Python-based low-code platform for visually building LLM/agent workflows, exposing a FastAPI backend under /api/v1/. The flaw is a CWE-306 (Missing Authentication for a Critical Function): the /api/v1/login/auto_login route is designed as a convenience for single-user/local deployments, issuing a superuser JWT bearer token so users can skip a login screen. When AUTO_LOGIN is enabled (the shipped default), this token-issuing behavior is reachable by anyone who can reach the API, so a security-sensitive function - minting privileged session tokens - executes with no identity check. The CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* confirms the affected component is the Langflow OSS application itself. A secondary weakness is permissive CORS configuration, which weakens browser same-origin protections and can allow the issued token to be read by attacker-controlled web origins.

RemediationAI

Patch available per IBM advisory: upgrade Langflow OSS to the fixed release identified in IBM support document https://www.ibm.com/support/pages/node/7278926 (the input confirms a vendor patch but does not state the exact fixed version number, so verify it in the advisory before deploying). As an immediate compensating control on unpatched instances, disable auto-login by setting AUTO_LOGIN to false and configuring real authenticated superuser credentials (LANGFLOW_SUPERUSER / LANGFLOW_SUPERUSER_PASSWORD); the trade-off is that all users must now log in, breaking any tooling that relied on the tokenless flow. Additionally, tighten the CORS configuration to an explicit allow-list of trusted origins rather than a permissive wildcard to prevent token exposure to hostile web origins, and restrict network reachability of the Langflow API - bind it to localhost or place it behind an authenticating reverse proxy / VPN so the /api/v1/login/auto_login endpoint is not exposed to untrusted networks.