What is the CVSS score of EUVD-2026-53544?

EUVD-2026-53544 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-53544?

Yes, a patch is available for EUVD-2026-53544. Update the affected software to the latest version immediately.

IBM Langflow OSS EUVD-2026-53544

| CVE-2026-10128 MEDIUM

Information Exposure (CWE-200)

2026-08-05 ibm

GHSA-47c3-vjq8-vj9m

Information Disclosure IBM Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with low complexity; authenticated user access (PR:L) required; only confidentiality impacted via environment variable disclosure, no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:24 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components.

AnalysisAI

Authenticated users in IBM Langflow OSS 1.0.0 through 1.10.3 can exploit a privileged built-in component to read arbitrary server-side environment variables, bypassing security controls designed to restrict custom component execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms this is a low-complexity, network-accessible flaw requiring only standard user credentials, with high confidentiality impact. No active exploitation confirmed via CISA KEV, and no public exploit code has been identified at time of analysis; IBM has released a patch via its support portal.

Technical ContextAI

Langflow is a visual, open-source framework for composing LLM-powered workflows, built on a component model where users wire together pre-built or custom nodes to form pipelines. The CPE (cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*) covers the full IBM OSS distribution from 1.0.0 through 1.10.3. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): a built-in Langflow component retains the ability to read server process environment variables even when the platform's security controls are configured to disable or restrict custom component execution. This represents an incomplete mediation of access controls - the mechanism intended to fence off dangerous operations does not apply uniformly to all native built-in components. Environment variables in LLM orchestration platforms commonly hold API keys (OpenAI, Anthropic, cloud providers), database connection strings, and OAuth secrets, making their disclosure high-impact despite the medium overall score.

RemediationAI

The primary remediation is to apply the vendor-released patch documented at https://www.ibm.com/support/pages/node/7282648; an exact fixed version number was not independently confirmed in the available data (described as 'patch available' without a tagged release version). Until patching is possible, compensating controls should focus on access minimization: restrict Langflow authenticated user accounts strictly to only those individuals who require workflow authoring access, as any authenticated user can trigger the vulnerable built-in component. Where Langflow is deployed in multi-tenant configurations or exposed to untrusted authenticated users, consider rotating any secrets stored in the server's environment variables to values scoped exclusively to the Langflow process, thereby limiting the blast radius of disclosure. Additionally, audit Langflow server environment variables and remove any secrets not strictly required by the platform - substituting external secrets management (e.g., HashiCorp Vault, AWS Secrets Manager) reduces exposure even if the vulnerability is triggered. Note that tightening network access or disabling component categories at the application layer may not prevent this flaw, as the vulnerable component is a built-in that bypasses those controls.