CVE-2026-10128 - Langflow is affected by weaknesses in secret handling and sensitive configuration access

Back Back to CVE browser

MEDIUM

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Published Aug 5, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.10.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Langflow OSS

n/a

Version	Status	Constraints
1.0.0	affected	<=1.10.3

Remediation

Vendor solution

IBM recommends upgrading to Langflow OSS 1.11.0 or newer https://github.com/langflow-ai/langflow/releases

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (1)

https://www.ibm.com/support/pages/node/7282648
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7282648		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Aug 5, 2026

Updated Aug 6, 2026

Reserved May 29, 2026

Link CVE-2026-10128

CISA Vulnrichment

Updated Aug 6, 2026

NVD

Status Analyzed

Modified Aug 6, 2026

Link CVE-2026-10128

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-10128