CVE-2026-101329: Langflow: improper access control exposes sensitive data

MEDIUM

Published October 7, 2026

CISO Take

Langflow OSS 1.0.0 through 1.12.2 has an improper access control flaw (CWE-284) that lets any authenticated user with low privileges read sensitive information they shouldn't see, with high confidentiality impact but no integrity or availability impact. The EPSS score is low (0.0026, around the 84th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, so mass exploitation looks unlikely in the short term. Even so, Langflow instances usually store LLM provider API keys, vector database credentials and flow definitions, so a leak can have an impact well beyond the CVSS 6.5. Review the IBM advisory (ibm.com/support/pages/node/7290694), upgrade to the fixed version it names, and rotate any credentials stored in Langflow if you run multi-user or externally exposed deployments. The exact fixed version and the affected endpoints are not listed in the data available, so confirm them in the vendor advisory.

Sources:NVDEPSSibm.comATLAS

What is the risk?

Medium. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N) means it is remotely exploitable with low complexity and no user interaction, but it requires a valid account. The impact is confidentiality only (C:H/I:N/A:N). There is no KEV listing, no public exploit and no scanner template, and EPSS is low (0.0026). The risk grows in shared or multi-tenant Langflow deployments and in instances where open sign-up or many low-trust users have accounts. Specific details of the flaw (which resources are exposed) are not public.

How does the attack unfold?

Initial Access

Attacker authenticates with a valid low-privilege Langflow account.

AML.T0012

Exploitation

Attacker abuses missing authorization checks to request resources they should not access.

AML.T0049

Collection

Attacker reads flows, variables and configuration of other users or projects.

AML.T0036

Impact

Leaked secrets enable access to LLM providers and data stores, and cost abuse.

AML.T0055

Initial Access

Attacker authenticates with a valid low-privilege Langflow account.

AML.T0012

Exploitation

Attacker abuses missing authorization checks to request resources they should not access.

AML.T0049

Collection

Attacker reads flows, variables and configuration of other users or projects.

AML.T0036

Impact

Leaked secrets enable access to LLM providers and data stores, and cost abuse.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow to the fixed release listed in the IBM advisory (above 1.12.2). 2) Until patched, restrict access to the Langflow UI and API to trusted networks (VPN, allowlist, reverse proxy with SSO), and disable open registration. 3) Apply least privilege: review which accounts exist and remove unused ones. 4) Rotate API keys and secrets stored in Langflow (LLM providers, vector databases, third-party tools) if the instance was exposed to untrusted users. 5) Detection: review access logs for low-privilege accounts querying resources from other users or projects, unusual API calls to flow or variable listing endpoints, and enumeration patterns. 6) Keep Langflow in your software inventory and watch the vendor advisory for updates.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAgentAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Security of AI system data

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage AI system vulnerabilities

OWASP LLM Top 10

LLM06-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-101329?

Is CVE-2026-101329 actively exploited?

No confirmed active exploitation of CVE-2026-101329 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-101329?

1) Upgrade Langflow to the fixed release listed in the IBM advisory (above 1.12.2). 2) Until patched, restrict access to the Langflow UI and API to trusted networks (VPN, allowlist, reverse proxy with SSO), and disable open registration. 3) Apply least privilege: review which accounts exist and remove unused ones. 4) Rotate API keys and secrets stored in Langflow (LLM providers, vector databases, third-party tools) if the instance was exposed to untrusted users. 5) Detection: review access logs for low-privilege accounts querying resources from other users or projects, unusual API calls to flow or variable listing endpoints, and enumeration patterns. 6) Keep Langflow in your software inventory and watch the vendor advisory for updates.

What systems are affected by CVE-2026-101329?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, multi-tenant AI development platforms.

What is the CVSS score for CVE-2026-101329?

CVE-2026-101329 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationmulti-tenant AI development platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0055Unsecured Credentials

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.

Exploitation Scenario

An attacker obtains a low-privilege account on a shared Langflow instance, through open sign-up, a compromised user or a contractor account. They call API endpoints with missing authorization checks and read flows, variables or configuration belonging to other users. From these they extract OpenAI or Anthropic keys and vector database credentials, then use them to access proprietary data, run up costs on the model provider, or pivot to connected internal systems.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.