EUVD-2026-67953
GHSA-7rh9-6r38-qv3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-exposed Langflow instance
-
DeliverySend unauthenticated HTTP request to flow API
-
ExploitAuthentication check bypassed
-
ExecutionExecute arbitrary stored flows
-
ImpactExfiltrate sensitive data or embedded secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) - this is remote unauthenticated exploitation against network-accessible IBM Langflow OSS 1.0.0-1.11.1 instances with no non-default configuration required. The primary limiting factor is network reachability: instances not exposed to untrusted networks (e.g., air-gapped or strictly firewalled deployments) cannot be reached by external attackers. No specific Langflow feature flag, plugin, or configuration mode is cited in the available data as a prerequisite for the vulnerability. |
| Impact | The CVSS 8.2 High rating is well-supported by the vector metrics: AV:N (network-accessible), AC:L (no special conditions), PR:N (no authentication required), and UI:N (no user interaction needed), yielding a low-friction exploitation path. The C:H impact reflects that sensitive information - potentially including API keys embedded in flows, LLM query results, or connected data sources - is accessible to an unauthenticated attacker. I:L captures the limited write-capability from arbitrary flow execution. No EPSS data was provided in the source intelligence, and the vulnerability does not appear in CISA KEV at time of analysis, suggesting exploitation has not yet been observed at scale. However, authentication bypass vulnerabilities on workflow platforms with network exposure are historically high-value targets. The absence of KEV listing does not diminish urgency given the trivially low attack complexity - this should be treated as a critical patch priority for internet-facing deployments. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies a network-accessible IBM Langflow OSS instance (e.g., via internet scanning on common Langflow ports) and sends crafted API requests to the flow execution endpoint without providing credentials. The authentication check is bypassed, allowing the attacker to enumerate, trigger, or modify existing flows - extracting embedded secrets, API keys, or data processed by those flows without any account access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Remote unauthenticated execution of arbitrary AI workflows in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information via an authentication bypass (CWE-287). The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms zero prerequisites - any network-reachable instance can be targeted without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial attack complexity combined with high confidentiality impact and vendor-confirmed patch availability makes this an immediate remediation priority for any organization running an exposed Langflow instance.
RemediationAI
A patch is available per the vendor advisory at https://www.ibm.com/support/pages/node/7284579; organizations should consult that page for the exact fixed version and upgrade immediately. Because no exact fix version number was independently confirmed in the provided data, the advisory page must be used to determine the precise target version. As a compensating control prior to patching, restrict network access to the Langflow API surface via firewall rules or network segmentation so that only authorized internal hosts can reach the service - this directly raises the effective attack vector from network to a controlled perimeter. Additionally, if Langflow supports authentication configuration, audit and enforce authentication on all API endpoints as documented. Note that network restriction does not remediate the underlying flaw and should not be treated as a permanent substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Langflow OSS is IBM's distribution of the Langflow open-source AI/LLM workflow orchestration platform, which exposes an API surface for creating and executing AI pipelines ('flows'). The affected CPE (cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*) covers all versions from 1.0.0 through 1.11.1. CWE-287 (Improper Authentication) indicates the root cause is a failure to enforce authentication controls on one or more API endpoints that handle flow execution or data retrieval. In Langflow's architecture, flows can interact with external data sources, LLM APIs, and internal data - making unauthorized flow execution a vector for both data exfiltration and potential abuse of connected integrations. The CVSS vector (AV:N) confirms the vulnerable surface is network-reachable without local access.
Know when Langflow Oss gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-accessible auth bypass requires no credentials or interaction; C:H reflects sensitive data exposure; I:L for limited flow execution write impact; A:N as no availability disruption is described.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
Executive ViewAI
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an authentication bypass vulnerability (CWE-287) allowing unauthenticated remote attackers to execute arbitrary AI workflows and access sensitive information from any exposed instance. Organizations using these versions face immediate risk of unauthorized data access to workflow configurations and model details. Patch availability enables rapid remediation to eliminate this critical exposure vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the servi
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
IBM Langflow OSS 1.0.0 through 1.12.8 allows unauthenticated remote attackers to bypass security restrictions through im
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-l
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run
Remote OS command execution in IBM Langflow OSS (versions 1.0.0 through 1.11.5) lets remote attackers run arbitrary oper
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP `resources/r
Exploit-DB