What is the CVSS score of EUVD-2026-94129?

EUVD-2026-94129 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by EUVD-2026-94129?

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a high-severity vulnerability that allows any authenticated low-privileged user to retrieve stored credentials, such as integration keys and API…. A patch is available.

How to fix or mitigate EUVD-2026-94129?

Within 24 hours, identify all instances of IBM Langflow OSS versions 1.0.0 through 1.12.2 in your environment and restrict access to only fully trusted users; monitor logs for any unusual credential retrieval activity. Within 7 days, apply the vendor-released patch from IBM's support advisory to all affected systems, and rotate any stored credentials (API tokens, integration keys) that may have been exposed. Within 30 days, complete patching across all environments, conduct a thorough audit of stored secrets, enforce least-privilege access controls, and review multi-tenant configurations to ensure low-privileged accounts cannot access sensitive credentials. Note that no public exploit has been identified at this time, but the availability of a patch makes immediate remediation feasible.

IBM Langflow OSS EUVD-2026-94129

| CVE-2026-101331 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-10-06 ibm

GHSA-4mr4-mxhm-g7v2

Information Disclosure IBM Langflow Oss

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable but requires a valid low-privileged account (PR:L); disclosed credentials grant access beyond the component (S:C, C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Oct 08, 2026 - 18:23 NVD

HIGH MEDIUM

CVSS changed

Oct 08, 2026 - 18:23 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Oct 07, 2026 - 00:49 vuln.today

CVE Published

Oct 06, 2026 - 23:58 cve.org

HIGH 7.7

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

AnalysisAI

Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated session on the IBM Langflow OSS instance at a low privilege level (PR:L), so the attacker must possess valid credentials or access to a provisioned account - this is the primary limiting factor and rules out anonymous internet exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) indicates a network-reachable flaw requiring only low privileges and no user interaction, with a scope change (S:C) and high confidentiality impact but no integrity or availability effect - consistent with a credential-disclosure weakness (CWE-522). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: apply IBM's fix from https://www.ibm.com/support/pages/node/7290694, moving off the affected 1.0.0 through 1.12.2 range to the corrected build listed there. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all instances of IBM Langflow OSS versions 1.0.0 through 1.12.2 in your environment and restrict access to only fully trusted users; monitor logs for any unusual credential retrieval activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.