Langflow: IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-13446
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 17, 2026
- Source last modified
- October 24, 2026
Description
IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Description quoted from the NVD record.
Who is affected
This flaw affects Langflow (also called IBM Langflow OSS), a tool for building apps that use AI language models. It affects versions 1.0.0 through 1.10.1. These versions contain built-in secrets, such as a password or an encryption key, written into the product itself. Langflow uses these secrets to check who is allowed to log in, to connect to other services it works with, or to scramble its own stored data. This flaw is rated Critical.
What to do
- If someone in your organization installed or runs Langflow, ask them which version is in use.
- Any version from 1.0.0 through 1.10.1 is affected. No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- When a fixed release is available, have the person who runs Langflow install it as soon as possible.
- If an IT provider or vendor runs Langflow for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.