CVE-2026-12945 - Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Back Back to CVE browser

HIGH

Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Published Jul 30, 2026

7.1

HIGH

CVSS 3.1

EPSS 0.36%

Description

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.10.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Langflow OSS

n/a

Version	Status	Constraints
1.0.0	affected	<=1.10.1

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.2 https://pypi.org/project/langflow/

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51242
Advisory
https://www.ibm.com/support/pages/node/7279994
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51242		Advisory
https://www.ibm.com/support/pages/node/7279994		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Jul 30, 2026

Updated Jul 31, 2026

Reserved Jun 22, 2026

Link CVE-2026-12945

CISA Vulnrichment

Updated Jul 31, 2026

NVD

Status Analyzed

Modified Aug 4, 2026

Link CVE-2026-12945

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-12945

ENISA EUVD

Assigner ibm

Published Jul 30, 2026

Updated Jul 31, 2026

Exploited since n/a

Link EUVD-2026-51242

EUVD-2026-51242