EUVD-2026-40401
GHSA-w636-w53p-5frh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 02, 2026
Information disclosure and denial of service in IBM Langflow OSS 1.0.0 through 1.9.6 stem from missing authentication on the /api/v1/build_public_tmp/ endpoints, letting an unauthenticated attacker who supplies a valid job identifier read build event data or cancel running jobs. The flaw carries a CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and CWE-287 classification; there is no public exploit identified at time of analysis, and EPSS is low at 0.25% (17th percentile) with CISA SSVC recording no observed exploitation but flagging it as automatable.
Earlier versions of this analysis (2)
Missing authentication on the /api/v1/build_public_tmp/ endpoints in IBM Langflow OSS (1.0.0 through 1.9.6) lets an unauthenticated remote attacker read build event data or cancel running jobs by supplying a valid job identifier, yielding information disclosure and denial of service. IBM PSIRT scored it CVSS 9.1, though the practical impact is bounded by needing a valid job ID and is limited to build-event data and per-job cancellation. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.25% (17th percentile).
Information disclosure and denial of service in IBM Langflow OSS 1.0.0 through 1.9.6 stem from missing authentication on the /api/v1/build_public_tmp/ endpoints, letting a remote attacker who holds a valid job identifier read build event data or cancel running jobs without any credentials (CVSS 8.2, AV:N/PR:N). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated network reach makes it a meaningful exposure for any internet-facing Langflow instance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Unauthenticated and network-reachable (AV:N/PR:N), but scope is limited to build-event data and per-job cancellation for a known job ID, so C:L and A:L rather than High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.
Executive ViewAI
IBM Langflow OSS versions 1.0.0-1.9.6 expose unauthenticated access to build management APIs, allowing attackers to read sensitive LLM development data and cancel production jobs without credentials. Organizations deploying these versions with network access face immediate risk of intellectual property disclosure and operational disruption. No vendor patch is available, requiring urgent network isolation or version upgrade within 24 hours.
Within 24 hours: Identify all Langflow 1.0.0-1.9.6 deployments (especially internet-facing); restrict network access to /api/v1/build_public_tmp/ endpoints to internal/VPN-only via firewall or WAF rules; inventory active jobs and build data classifications. Within 7 days: Evaluate upgrade path to Langflow 2.0+ (if available) or alternative orchestration platform; if blocked, implement API Gateway or reverse-proxy authentication (AWS API Gateway, Azure APIM, nginx) as overlay on all Langflow APIs. Within 30 days: Complete migration to patched version; audit access logs for unauthorized job access; update incident response procedures for Langflow API compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict all Langflow API endpoints to internal-only access via firewall/WAF rules until patched; (2) API authentication overlay-prepend reverse proxy or API Gateway (nginx, HAProxy, AWS API Gateway) requiring API key or OAuth credentials for all client-to-Langflow requests; (3) Configuration hardening-disable public/unauthenticated job builds if configurable; (4) Urgent upgrade to next stable release after staging validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Exploit-DB