CVE-2026-10128: Langflow built-in component leaks

CISO Take

A built-in Langflow component lets any authenticated user read arbitrary server-side environment variables, even on instances where administrators have explicitly disabled custom components to prevent this exact class of abuse. The confidentiality impact is high — environment variables in Langflow deployments routinely hold LLM provider API keys, database connection strings, and cloud credentials — but the practical risk is tempered by the need for a low-privileged authenticated account (PR:L), no public exploit code or Nuclei template, an EPSS score of just 0.00224, and a CISA SSVC decision of TRACK, the lowest urgency tier. The real exposure is concentrated in multi-tenant or shared Langflow instances where flow-builder access is handed to users who shouldn't have infrastructure-level visibility. Patch to the fixed release referenced in IBM's advisory, and until then treat any shared Langflow deployment as if its secrets are readable by every logged-in user. Detection-wise, audit flow execution logs for use of the affected built-in component and rotate any credentials that were stored as plain environment variables on exposed instances.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

Medium severity (CVSS 6.5, C:H/I:N/A:N) reflecting a pure confidentiality break with no integrity or availability impact. Exploitability is low-complexity and needs no user interaction, but it does require an authenticated, low-privileged account — this is an insider/lateral-movement risk more than an internet-drive-by risk. No KEV listing, no public PoC, no scanner template, and a TRACK SSVC decision all point to low active-exploitation likelihood today, but the bypass of an intentional security control (disabled custom components) is notable: it means the mitigation admins believed protected them does not. Any Langflow instance shared across teams, tenants, or trial users should treat this as materially higher risk than the CVSS score alone suggests.

How does the attack unfold?

Initial Access

Adversary obtains or already holds a valid, low-privileged authenticated Langflow account.

AML.T0012

Component Abuse

Adversary adds the affected built-in component to a flow, bypassing the admin-configured restriction that disables custom components.

AML.T0053

Secret Disclosure

Running the flow returns arbitrary server environment variables, exposing API keys, database credentials, and cloud tokens.

AML.T0083

Downstream Compromise

Adversary uses the exfiltrated credentials to pivot into connected LLM provider accounts, databases, or cloud infrastructure.

AML.T0025

Initial Access

Adversary obtains or already holds a valid, low-privileged authenticated Langflow account.

AML.T0012

Component Abuse

Adversary adds the affected built-in component to a flow, bypassing the admin-configured restriction that disables custom components.

AML.T0053

Secret Disclosure

Running the flow returns arbitrary server environment variables, exposing API keys, database credentials, and cloud tokens.

AML.T0083

Downstream Compromise

Adversary uses the exfiltrated credentials to pivot into connected LLM provider accounts, databases, or cloud infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed yesterday 17% patched ~70d to patch Full package profile →
Langflow	pip	—	No patch
155.0K Pushed yesterday 17% patched ~70d to patch Full package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Patch Langflow to the version fixing this issue per IBM's advisory (https://www.ibm.com/support/pages/node/7282648) as soon as it's validated in staging. Until patched: remove or restrict the affected built-in component from the component library where feasible, avoid storing high-value secrets (LLM provider keys, DB creds, cloud tokens) as plain environment variables accessible to the Langflow process — move to a secrets manager with scoped injection instead. Enforce least-privilege on Langflow accounts so flow-building access isn't handed to users who don't need infrastructure secret exposure, and audit/monitor flow execution logs for invocations of the environment-reading component as a detection signal. Rotate any credentials that were exposed to shared or multi-tenant instances prior to patching.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Framework Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Security of AI systems

NIST AI RMF

MANAGE-2.3 - Mechanisms for responding to negative AI system risks

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-10128?

A built-in Langflow component lets any authenticated user read arbitrary server-side environment variables, even on instances where administrators have explicitly disabled custom components to prevent this exact class of abuse. The confidentiality impact is high — environment variables in Langflow deployments routinely hold LLM provider API keys, database connection strings, and cloud credentials — but the practical risk is tempered by the need for a low-privileged authenticated account (PR:L), no public exploit code or Nuclei template, an EPSS score of just 0.00224, and a CISA SSVC decision of TRACK, the lowest urgency tier. The real exposure is concentrated in multi-tenant or shared Langflow instances where flow-builder access is handed to users who shouldn't have infrastructure-level visibility. Patch to the fixed release referenced in IBM's advisory, and until then treat any shared Langflow deployment as if its secrets are readable by every logged-in user. Detection-wise, audit flow execution logs for use of the affected built-in component and rotate any credentials that were stored as plain environment variables on exposed instances.

Is CVE-2026-10128 actively exploited?

No confirmed active exploitation of CVE-2026-10128 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-10128?

Patch Langflow to the version fixing this issue per IBM's advisory (https://www.ibm.com/support/pages/node/7282648) as soon as it's validated in staging. Until patched: remove or restrict the affected built-in component from the component library where feasible, avoid storing high-value secrets (LLM provider keys, DB creds, cloud tokens) as plain environment variables accessible to the Langflow process — move to a secrets manager with scoped injection instead. Enforce least-privilege on Langflow accounts so flow-building access isn't handed to users who don't need infrastructure secret exposure, and audit/monitor flow execution logs for invocations of the environment-reading component as a detection signal. Rotate any credentials that were exposed to shared or multi-tenant instances prior to patching.

What systems are affected by CVE-2026-10128?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, multi-tenant deployments.

What is the CVSS score for CVE-2026-10128?

CVE-2026-10128 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesmulti-tenant deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components.

Exploitation Scenario

A contractor or low-privileged team member with a valid but restricted Langflow account builds a flow and drags in the affected built-in component — no custom code upload required, since the org has (correctly, they believed) disabled custom components. Running the flow returns the server's environment variables in the component output, including the OpenAI/Anthropic API key backing the org's production chatbot, the Postgres connection string for the vector store, and an AWS access key used by a connected S3 loader. The user now has standing credentials to pivot into the LLM provider billing account, the database, and cloud storage — all without ever triggering an alert, since this looks like normal flow-building activity.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.