CVE-2026-13444

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

View on CVE.org

Published Jul 30, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

Analysis

Technical impact

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain insecure API endpoints that do not enforce proper authorization. An attacker can create a flow that references the exact persist_directory and collection_name used by another user, thereby retrieving that user's private vector documents. Additionally, the attacker can inject arbitrary documents into the same collection, corrupting shared data. This leads to a breach of confidentiality and integrity for users’ private information.

Affected Systems

Affected systems are IBM Langflow OSS installations running any version from 1.0.0 up to and including 1.10.1. The product can be updated through the IBM Langflow OSS PyPI package.

Risk and Exploitability

The CVSS base score is 8.1, indicating high severity. EPSS score of < 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but because the flaw can be exploited remotely with only unauthenticated API requests, the practical exploitation likelihood is high. Attackers can send crafted API calls over the network to retrieve or tamper with private flows without any user interaction or elevated privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

Langflow OSS

affected

Version	Status	Constraints
`1.0.0`	affected	≤ 1.10.1

Configuration 1 [-]

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Ibm

Langflow Oss

Version	Status	Scheme	Platform
`[1.0.0,1.10.1]`	affected	semver	—

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.2 https://pypi.org/project/langflow/

OpenCVE Recommended Actions

Upgrade IBM Langflow OSS to version 1.10.2 or later, as the vendor explicitly recommends this to mitigate the vulnerability.
Apply strict authentication and authorization checks on all API endpoints that expose user data, ensuring that only the rightful owner can create or access flows linked to a specific persist_directory or collection_name.
Segment or isolate Chroma namespaces so that shared collections are not globally accessible during migration to a patched version, and monitor for unauthorized document insertion or anomalous flow creation.

Generated by OpenCVE AI on August 2, 2026 at 05:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.350% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7279989

History

Jul 30, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 7:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.
Title		Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
First Time appeared		Ibm Ibm langflow Oss
Weaknesses		CWE-520
CPEs		cpe:2.3:a:ibm:langflow_oss:1.0.0:::::::* cpe:2.3:a:ibm:langflow_oss:1.10.1:::::::*
Vendors & Products		Ibm Ibm langflow Oss
References		https://www.ibm.com/support/pages/node/7279989