CVE-2026-110200: Langflow: cleartext credential storage exposes secrets

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.4 store sensitive information in cleartext (CWE-312), so any authenticated user with low privileges can read secrets over the network that should have been protected. Langflow typically holds LLM provider API keys, vector database credentials and other service tokens, so a single read can lead to account takeover of downstream AI services and cost abuse. Risk is moderate: CVSS is 6.5 (confidentiality only), there is no CISA KEV listing, no public exploit and no Nuclei template, and no EPSS score is available yet, so there is no sign of active exploitation. Upgrade to the fixed version listed in the IBM advisory (ibm.com/support/pages/node/7293016), rotate any API keys and credentials stored in Langflow, and restrict Langflow accounts to trusted users until patched.

Sources:NVDibm.comATLAS

What is the risk?

Medium. The flaw is network-reachable, low complexity, needs only low privileges and no user interaction, and the impact is a high loss of confidentiality with no integrity or availability impact. Exploitation requires a valid account, which limits exposure on single-user or well-segmented deployments. Risk rises on multi-user or shared Langflow instances, and on internet-exposed instances that allow open sign-up, because the exposed secrets often unlock paid LLM APIs and internal data stores. There is no EPSS score, KEV listing, public exploit or scanner template at publication, so likelihood of near-term exploitation is unquantified but appears low. Treat as medium priority with fast credential rotation.

How does the attack unfold?

Initial Access

The attacker authenticates to a Langflow instance with a low-privilege account.

AML.T0012

Credential Discovery

The attacker reads flow, variable or configuration data where secrets are stored in cleartext.

AML.T0055

Credential Harvesting

The attacker collects LLM API keys, vector database credentials and tool tokens from Langflow configuration.

AML.T0083

Impact

The attacker uses the stolen secrets to abuse LLM APIs, extract RAG data and move into connected systems.

AML.T0025

Initial Access

The attacker authenticates to a Langflow instance with a low-privilege account.

AML.T0012

Credential Discovery

The attacker reads flow, variable or configuration data where secrets are stored in cleartext.

AML.T0055

Credential Harvesting

The attacker collects LLM API keys, vector database credentials and tool tokens from Langflow configuration.

AML.T0083

Impact

The attacker uses the stolen secrets to abuse LLM APIs, extract RAG data and move into connected systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed release named in IBM's advisory (https://www.ibm.com/support/pages/node/7293016); versions 1.0.0 through 1.12.4 are affected. 2) Rotate every API key, database password and token that has been stored in or entered through Langflow, since previous exposure cannot be ruled out. 3) Limit Langflow accounts to trusted users, disable open sign-up and put the instance behind SSO, a VPN or an IP allowlist. 4) Move secrets to a secrets manager or environment variables and use Langflow's global variable and credential-type features where available, instead of hard-coding values in flows. 5) Encrypt the Langflow database and its backups at rest and limit file system and database access. 6) Detection: review authentication and API access logs for unusual reads of flow, variable or settings endpoints by low-privileged accounts, and monitor upstream provider usage for unexpected keys, IP addresses or spend spikes.

How is it classified?

Data LeakageData ExtractionFrameworkAgentAML.T0012- Valid Accounts AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-110200?

Is CVE-2026-110200 actively exploited?

No confirmed active exploitation of CVE-2026-110200 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110200?

1) Upgrade Langflow OSS to the fixed release named in IBM's advisory (https://www.ibm.com/support/pages/node/7293016); versions 1.0.0 through 1.12.4 are affected. 2) Rotate every API key, database password and token that has been stored in or entered through Langflow, since previous exposure cannot be ruled out. 3) Limit Langflow accounts to trusted users, disable open sign-up and put the instance behind SSO, a VPN or an IP allowlist. 4) Move secrets to a secrets manager or environment variables and use Langflow's global variable and credential-type features where available, instead of hard-coding values in flows. 5) Encrypt the Langflow database and its backups at rest and limit file system and database access. 6) Detection: review authentication and API access logs for unusual reads of flow, variable or settings endpoints by low-privileged accounts, and monitor upstream provider usage for unexpected keys, IP addresses or spend spikes.

What systems are affected by CVE-2026-110200?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Vector database integrations, Multi-user AI development platforms.

What is the CVSS score for CVE-2026-110200?

CVE-2026-110200 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationVector database integrationsMulti-user AI development platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.

Exploitation Scenario

An attacker obtains a low-privilege account on a shared Langflow server, through open registration, a phished user or a reused password. They authenticate and query the API or UI for flows, variables or configuration, and find that provider API keys and database credentials are returned in cleartext. They use the OpenAI or Anthropic key to run costly inference at the victim's expense, and the vector database credentials to extract proprietary documents indexed for RAG. The attacker may then reuse harvested tokens for connected SaaS tools, extending access beyond the Langflow host.

Weaknesses (CWE)

CWE-312Cleartext Storage of Sensitive InformationPrimary CWE-312Cleartext Storage of Sensitive Information

CWE-312 — Cleartext Storage of Sensitive Information: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

[Implementation, System Configuration, Operation] When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
[Implementation, System Configuration, Operation] In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Source: MITRE CWE corpus.