CVE-2026-101331: Langflow: insufficiently protected credentials exposure

MEDIUM

Published October 7, 2026

CISO Take

Langflow OSS versions 1.0.0 through 1.12.2 (per IBM's advisory) store or expose credentials without adequate protection (CWE-522), letting any authenticated low-privilege user read sensitive secrets such as LLM provider API keys, vector database credentials and connected service tokens. The scope change in the CVSS vector (S:C) means the compromised credentials unlock systems well beyond Langflow itself. Near-term exploitation looks unlikely: EPSS is 0.0026 (84th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, the package carries 194 other CVEs and a 77/100 risk score, and Langflow has a history of heavy attacker interest. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694), rotate every credential stored in affected instances, and restrict Langflow to trusted users and networks until then.

Sources:NVDEPSSATLASibm.com

What is the risk?

High, driven by confidentiality impact (C:H) and a changed scope (S:C). Exploitation is network-based, low complexity, needs only low privileges and no user interaction. Likelihood is moderate to low today: EPSS 0.0026, not in KEV, no public exploit and no scanner template. Exposure rises sharply for multi-tenant or internet-facing Langflow deployments that grant accounts to many users. The advisory gives no patched version in the structured data, so confirm the fixed version with IBM. Confidence: MEDIUM, because the description is brief and technical detail is limited.

How does the attack unfold?

Initial Access

Attacker authenticates to Langflow with a low-privilege account obtained through registration, leaked login or compromise.

AML.T0012

Credential Access

Attacker retrieves insufficiently protected credentials stored in Langflow, such as LLM, vector database and API keys.

AML.T0055

Lateral Movement

Attacker uses the stolen secrets to reach connected LLM providers, data stores and cloud services outside Langflow.

AML.T0091.000

Impact

Attacker exfiltrates RAG data and sensitive information, and drives up inference costs.

AML.T0025

Initial Access

Attacker authenticates to Langflow with a low-privilege account obtained through registration, leaked login or compromise.

AML.T0012

Credential Access

Attacker retrieves insufficiently protected credentials stored in Langflow, such as LLM, vector database and API keys.

AML.T0055

Lateral Movement

Attacker uses the stolen secrets to reach connected LLM providers, data stores and cloud services outside Langflow.

AML.T0091.000

Impact

Attacker exfiltrates RAG data and sensitive information, and drives up inference costs.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow to the fixed version named in IBM advisory node/7290694 (anything above 1.12.2 once confirmed by the vendor). 2) Rotate all API keys, database passwords and tokens stored in or reachable from Langflow, and treat them as exposed if the instance had untrusted users. 3) Reduce accounts to trusted users, remove stale ones, and enforce least privilege and SSO or MFA. 4) Keep Langflow off the public internet, placing it behind a VPN or an authenticating reverse proxy. 5) Move secrets to an external secrets manager and use environment-variable references instead of values stored in flows. 6) Detection: review Langflow API access logs for authenticated users enumerating variables or credential endpoints, and watch LLM provider and cloud audit logs for use of keys from unexpected IPs or unusual spend.

How is it classified?

Data LeakageData ExtractionFrameworkRAGAML.T0012- Valid Accounts AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-101331?

Is CVE-2026-101331 actively exploited?

No confirmed active exploitation of CVE-2026-101331 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-101331?

1) Upgrade Langflow to the fixed version named in IBM advisory node/7290694 (anything above 1.12.2 once confirmed by the vendor). 2) Rotate all API keys, database passwords and tokens stored in or reachable from Langflow, and treat them as exposed if the instance had untrusted users. 3) Reduce accounts to trusted users, remove stale ones, and enforce least privilege and SSO or MFA. 4) Keep Langflow off the public internet, placing it behind a VPN or an authenticating reverse proxy. 5) Move secrets to an external secrets manager and use environment-variable references instead of values stored in flows. 6) Detection: review Langflow API access logs for authenticated users enumerating variables or credential endpoints, and watch LLM provider and cloud audit logs for use of keys from unexpected IPs or unusual spend.

What systems are affected by CVE-2026-101331?

This vulnerability affects the following AI/ML architecture patterns: LLM orchestration frameworks, RAG pipelines, agent frameworks, vector databases, low-code AI workflow platforms.

What is the CVSS score for CVE-2026-101331?

CVE-2026-101331 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

LLM orchestration frameworksRAG pipelinesagent frameworksvector databaseslow-code AI workflow platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, for example through a self-registered user, a leaked login or a compromised developer. They call the API endpoints that return flow or variable data and retrieve credentials that are insufficiently protected. With the recovered LLM provider keys and vector database credentials, they query the organization's RAG data, run costly inference, and use cloud or SaaS tokens to move laterally outside the Langflow environment.

Weaknesses (CWE)

CWE-522Insufficiently Protected CredentialsPrimary CWE-522Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.