What is the CVSS score of CVE-2026-93678?

CVE-2026-93678 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow OSS are affected by CVE-2026-93678?

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an authorization flaw that lets any holder of a valid low-privilege account read data objects belonging to other users or tenants.. A patch is available.

How to fix or mitigate CVE-2026-93678?

Within 24 hours, inventory every Langflow OSS 1.0.0 through 1.12.2 instance in the environment, confirm which are multi-user or multi-tenant and therefore most exposed, and restrict network reachability to trusted users or internal segments; also review identity and access logs for anomalous object-retrieval patterns by low-privilege accounts. Within 7 days, apply the vendor patch per IBM support node 7290694 (upgrade to a release above 1.12.2), starting with internet-facing and multi-tenant deployments, and validate that object-level authorization is enforced for cross-user requests after upgrade; revoke or rotate credentials for any accounts suspected of abuse. Within 30 days, complete patching across all remaining instances including development and staging, add automated dependency and version scanning so affected Langflow releases are flagged on introduction, and add regression tests or monitoring for cross-tenant data access to prevent recurrence.

IBM Langflow OSS CVE-2026-93678

EUVD-2026-94117 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-10-07 ibm

GHSA-f976-m8p3-mhcp

Authentication Bypass IBM Langflow Oss

7.6

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

6.5 MEDIUM

Authenticated IDOR (PR:L, AV:N, AC:L) disclosing sensitive data; a pure information-disclosure bug warrants C:H with I:N and A:N, unlike the input vector's I:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 00:46 vuln.today

CVE Published

Oct 07, 2026 - 00:01 cve.org

HIGH 7.6

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

AnalysisAI

Sensitive information disclosure in IBM Langflow OSS 1.0.0 through 1.12.2 allows a remote, low-privilege authenticated attacker to retrieve objects belonging to other users by manipulating a user-controlled identifier that the application fails to scope to the requesting principal (CWE-639, IDOR-style authorization bypass). The flaw is network-reachable with low attack complexity and no user interaction, but it is gated on the attacker already holding valid credentials for a low-privilege account (CVSS PR:L); the assessed impact is a high-confidentiality, read-only exposure with no demonstrated integrity or availability effect, so realistic risk concentrates in multi-user or multi-tenant Langflow deployments where a low-trust account can reach another tenant's or user's data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to already possess valid credentials for a low-privilege account on the target IBM Langflow OSS instance (CVSS PR:L) running an affected version (1.0.0 through 1.12.2); the instance must be network-reachable (AV:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) scores 7.6 (High) and indicates a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) with no user interaction - consistent with the CWE-639 improper-authorization (IDOR-style) weakness described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: IBM documents the fix through the support page at https://www.ibm.com/support/pages/node/7290694, and operators should upgrade Langflow OSS off the affected 1.0.0-1.12.2 range to the release identified there as soon as it is validated against their environment, since the exact patched version string is not enumerated in the supplied intelligence and must be read from the advisory itself. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Langflow OSS 1.0.0 through 1.12.2 instance in the environment, confirm which are multi-user or multi-tenant and therefore most exposed, and restrict network reachability to trusted users or internal segments; also review identity and access logs for anomalous object-retrieval patterns by low-privilege accounts. …

Threat intelligence, references, and detailed analysis are available after sign-in.