CVE-2026-104314: Langflow: flow share grant leaks owner's cleartext credentials

MEDIUM

Published October 29, 2026

CISO Take

Langflow OSS 1.0.0 through 1.12.3 (IBM advisory, CVE-2026-104314) returns a flow owner's stored third-party credentials in cleartext in API responses to any authenticated user holding only a read or share grant on that flow. The CVSS is a moderate 6.5, but the real impact is higher in practice because the exposed secrets are typically LLM provider keys, vector database tokens and cloud credentials that work outside Langflow. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so near-term mass exploitation looks unlikely. The risk is mainly insider or shared-tenant abuse, and exploitation needs only a low-privileged account and a single API call. Upgrade to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015), rotate every credential stored in shared flows, and review who has been granted read or share access.

Sources:NVDibm.comATLAS

What is the risk?

Medium by CVSS (6.5; network, low complexity, low privileges, no user interaction, high confidentiality impact only). Exploitability is easy for anyone with a legitimate low-privilege account and a read or share grant, but there is no known exploit, KEV listing or scanner template, and EPSS is unavailable. The business risk is higher than the score suggests. Stolen LLM API keys, database credentials and SaaS tokens can lead to cost abuse, data access and lateral movement beyond Langflow. Exposure is greatest in multi-user or multi-tenant Langflow deployments that use flow sharing. Single-user installs are largely unaffected. Confidence: MEDIUM, since the assessment rests on the NVD description and the IBM advisory.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege authenticated account with a read or share grant on a target flow.

AML.T0012

Credential Retrieval

Attacker requests the shared flow through the API and reads the owner's third-party credentials in cleartext from the response.

AML.T0055

Credential Abuse

Attacker uses the stolen LLM, database or cloud keys directly against the external services.

AML.T0091.000

Impact

Data theft from connected stores and cost abuse of AI provider accounts, with no visible trace in Langflow.

AML.T0048.000

Initial Access

Attacker obtains a low-privilege authenticated account with a read or share grant on a target flow.

AML.T0012

Credential Retrieval

Attacker requests the shared flow through the API and reads the owner's third-party credentials in cleartext from the response.

AML.T0055

Credential Abuse

Attacker uses the stolen LLM, database or cloud keys directly against the external services.

AML.T0091.000

Impact

Data theft from connected stores and cost abuse of AI provider accounts, with no visible trace in Langflow.

AML.T0048.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow to the fixed release named in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions above 1.12.3 are expected to carry the fix, so confirm in the advisory. 2) Rotate all third-party credentials (LLM provider keys, vector DB tokens, cloud keys) stored in any flow that was shared or readable by other users. 3) Until patched, revoke unnecessary read and share grants and restrict Langflow access to trusted users. 4) Move secrets into an external secrets manager or environment-level variables with least privilege and per-key spending limits. 5) Detection: review API access logs for flow-read requests by non-owners and check provider-side logs for unusual use of the keys from unfamiliar IPs.

How is it classified?

Data LeakageData ExtractionFrameworkAPIAML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-104314?

Is CVE-2026-104314 actively exploited?

No confirmed active exploitation of CVE-2026-104314 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104314?

1) Upgrade Langflow to the fixed release named in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions above 1.12.3 are expected to carry the fix, so confirm in the advisory. 2) Rotate all third-party credentials (LLM provider keys, vector DB tokens, cloud keys) stored in any flow that was shared or readable by other users. 3) Until patched, revoke unnecessary read and share grants and restrict Langflow access to trusted users. 4) Move secrets into an external secrets manager or environment-level variables with least privilege and per-key spending limits. 5) Detection: review API access logs for flow-read requests by non-owners and check provider-side logs for unusual use of the keys from unfamiliar IPs.

What systems are affected by CVE-2026-104314?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM orchestration platforms, Multi-user AI workflow builders.

What is the CVSS score for CVE-2026-104314?

CVE-2026-104314 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM orchestration platformsMulti-user AI workflow builders

MITRE ATLAS Techniques

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response.

Exploitation Scenario

An attacker with a low-privilege Langflow account, such as a contractor or a compromised employee login, is given or obtains read access to a shared RAG or agent flow. They request the flow through the API and find the owner's OpenAI, vector database and cloud storage credentials in cleartext in the response. They use the keys outside Langflow to run up LLM costs, read proprietary documents from the vector store, or reach the connected cloud resources. The owner sees no sign of compromise inside Langflow.

Weaknesses (CWE)

CWE-522Insufficiently Protected CredentialsPrimary CWE-522Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.