CVE-2026-110245: Langflow improper authentication

CISO Take

CVE-2026-110245 is an improper authentication flaw (CWE-287) in IBM Langflow OSS 1.0.0 through 1.12.4 that lets an unauthenticated remote attacker retrieve sensitive information over the network with no user interaction. Langflow typically stores LLM provider API keys, vector database credentials, and flow definitions, so a successful read can cascade into compromise of connected AI services and data stores. Exploitation looks easy given the low complexity and no required privileges, but there is currently no public exploit, no Nuclei template, no CISA KEV listing, and no EPSS score, so there is no evidence yet of active exploitation. Inventory every Langflow instance, especially any exposed to the internet, upgrade beyond 1.12.4 as directed in IBM's advisory (https://www.ibm.com/support/pages/node/7293016), restrict network access in the meantime, and rotate any API keys and credentials held in flows if exposure is suspected.

Sources:NVDIBM Support (ibm.com)ATLAS

What is the risk?

High (CVSS 7.5). The vector is network-reachable, low complexity, needs no privileges or user interaction, and has a high confidentiality impact with no integrity or availability impact. Exploitation likelihood cannot be quantified because EPSS data is not available, and there is no public exploit, scanner template, or KEV listing as of publication. Exposure is greatest for internet-facing or shared-network Langflow deployments, and for those holding many provider secrets. Confidence in the analysis is MEDIUM because the description is brief and the vendor advisory details were not available.

How does the attack unfold?

Reconnaissance

Attacker discovers internet-exposed Langflow instances running versions 1.0.0 through 1.12.4.

AML.T0006

Initial Access

Attacker sends unauthenticated network requests that bypass the improper authentication check.

AML.T0049

Credential Access

Attacker reads exposed flows, variables, and configuration to harvest API keys and credentials.

AML.T0055

Impact

Stolen keys and data are used for unauthorized model usage and extraction of data from connected stores.

AML.T0048

Reconnaissance

Attacker discovers internet-exposed Langflow instances running versions 1.0.0 through 1.12.4.

AML.T0006

Initial Access

Attacker sends unauthenticated network requests that bypass the improper authentication check.

AML.T0049

Credential Access

Attacker reads exposed flows, variables, and configuration to harvest API keys and credentials.

AML.T0055

Impact

Stolen keys and data are used for unauthorized model usage and extraction of data from connected stores.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to a fixed release beyond 1.12.4 per the IBM advisory. 2) Until patched, do not expose Langflow to the internet; place it behind a VPN, reverse proxy with authentication, or IP allowlist. 3) Ensure authentication is enforced (disable auto-login and anonymous access settings) and review the deployment configuration. 4) Rotate LLM provider API keys, database credentials, and any secrets stored in flows or environment variables if the instance was reachable by untrusted networks. 5) Review access logs for unauthenticated requests to API endpoints returning flow, variable, or configuration data, and monitor for unexpected use of provider keys.

How is it classified?

Auth BypassData LeakageFrameworkAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110245?

CVE-2026-110245 is an improper authentication flaw (CWE-287) in IBM Langflow OSS 1.0.0 through 1.12.4 that lets an unauthenticated remote attacker retrieve sensitive information over the network with no user interaction. Langflow typically stores LLM provider API keys, vector database credentials, and flow definitions, so a successful read can cascade into compromise of connected AI services and data stores. Exploitation looks easy given the low complexity and no required privileges, but there is currently no public exploit, no Nuclei template, no CISA KEV listing, and no EPSS score, so there is no evidence yet of active exploitation. Inventory every Langflow instance, especially any exposed to the internet, upgrade beyond 1.12.4 as directed in IBM's advisory (https://www.ibm.com/support/pages/node/7293016), restrict network access in the meantime, and rotate any API keys and credentials held in flows if exposure is suspected.

Is CVE-2026-110245 actively exploited?

No confirmed active exploitation of CVE-2026-110245 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110245?

1) Upgrade Langflow OSS to a fixed release beyond 1.12.4 per the IBM advisory. 2) Until patched, do not expose Langflow to the internet; place it behind a VPN, reverse proxy with authentication, or IP allowlist. 3) Ensure authentication is enforced (disable auto-login and anonymous access settings) and review the deployment configuration. 4) Rotate LLM provider API keys, database credentials, and any secrets stored in flows or environment variables if the instance was reachable by untrusted networks. 5) Review access logs for unauthenticated requests to API endpoints returning flow, variable, or configuration data, and monitor for unexpected use of provider keys.

What systems are affected by CVE-2026-110245?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM orchestration platforms, Low-code AI workflow builders.

What is the CVSS score for CVE-2026-110245?

CVE-2026-110245 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM orchestration platformsLow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances and identifies one running a version between 1.0.0 and 1.12.4. They send crafted unauthenticated requests that bypass the authentication check and read protected resources such as flow definitions and stored variables. From these they harvest an OpenAI or Anthropic API key and a vector database credential. The attacker then uses the keys to run costly inference at the victim's expense and queries the vector store to extract proprietary documents indexed for RAG.

Weaknesses (CWE)

CWE-287Improper AuthenticationPrimary CWE-287Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.