CVE-2026-13442: Langflow FAISS namespace reuse leaks

CISO Take

A flaw in IBM's open-source Langflow platform lets an authenticated user reuse another tenant's FAISS vector-store namespace, exposing owner-only RAG content and, in some cases, letting the attacker plant poisoned data that corrupts that user's future query results. For CISOs running multi-tenant Langflow deployments — internal AI platforms, agent-building sandboxes, or customer-facing RAG apps — this breaks the confidentiality boundary between users and introduces a persistent integrity problem that doesn't self-correct once exploited. There's no public exploit or scanner template yet and the CVE isn't in CISA KEV, so this looks disclosed-but-not-weaponized rather than actively exploited in the wild, though CVSS 7.1 (network, low complexity, only low privileges required, no user interaction) makes it trivially reachable for anyone with a valid account. Patch to the fixed Langflow release once IBM publishes it; until then, audit which users share FAISS-backed vector stores, review namespace-assignment logic for predictability or reuse, and monitor for accounts querying vector namespaces outside their own project or tenant.

Sources: NVD ATLAS ibm.com

What is the risk?

Network-exploitable with low attack complexity and only low privileges required, and no user interaction — any authenticated Langflow user can attempt this. Confidentiality impact is high (cross-user vector content disclosure), integrity impact is limited but real (persistent poisoning of returned results), and there's no availability impact. No public exploit, no Nuclei template, no CISA KEV listing, and no EPSS score reduce near-term mass-exploitation risk, but the bug requires no special tooling beyond namespace guessing/reuse, so a motivated insider or low-privileged tenant in a shared deployment could exploit it today. Risk is concentrated in multi-tenant or SaaS-style Langflow installs where multiple users/projects share the same FAISS-backed vector store infrastructure.

How does the attack unfold?

Initial Access

Attacker authenticates to the Langflow instance with a valid low-privileged account.

AML.T0012

Namespace Discovery

Attacker identifies or guesses another user's FAISS vector-store namespace identifier due to weak isolation.

AML.T0064

Cross-Tenant Access

Attacker queries the reused namespace, retrieving owner-only vector content belonging to another user.

AML.T0085.000

Persistent Poisoning

Attacker writes malicious vectors into the shared namespace, corrupting the victim's future RAG query results.

AML.T0070

Initial Access

Attacker authenticates to the Langflow instance with a valid low-privileged account.

AML.T0012

Namespace Discovery

Attacker identifies or guesses another user's FAISS vector-store namespace identifier due to weak isolation.

AML.T0064

Cross-Tenant Access

Attacker queries the reused namespace, retrieving owner-only vector content belonging to another user.

AML.T0085.000

Persistent Poisoning

Attacker writes malicious vectors into the shared namespace, corrupting the victim's future RAG query results.

AML.T0070

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

Upgrade to the patched Langflow release as soon as IBM publishes one above 1.10.1. Until patched: enforce per-tenant isolation of FAISS indices at the infrastructure level (separate storage per user/project rather than relying on an app-level namespace string), verify namespace ownership checks are applied server-side on every read/write, and avoid predictable or attacker-influenceable namespace naming schemes. Audit existing multi-user deployments for evidence of namespace collisions or cross-account queries in application logs. If running Langflow as a shared/multi-tenant service, consider temporarily restricting FAISS-backed vector store usage to single-tenant configurations until the fix is deployed.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Auth Bypass RAG Framework AML.T0057 - LLM Data Leakage AML.T0064 - Gather RAG-Indexed Targets AML.T0070 - RAG Poisoning AML.T0085.000 - RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI System Security and Resilience

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure LLM08:2025 - Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-13442?

A flaw in IBM's open-source Langflow platform lets an authenticated user reuse another tenant's FAISS vector-store namespace, exposing owner-only RAG content and, in some cases, letting the attacker plant poisoned data that corrupts that user's future query results. For CISOs running multi-tenant Langflow deployments — internal AI platforms, agent-building sandboxes, or customer-facing RAG apps — this breaks the confidentiality boundary between users and introduces a persistent integrity problem that doesn't self-correct once exploited. There's no public exploit or scanner template yet and the CVE isn't in CISA KEV, so this looks disclosed-but-not-weaponized rather than actively exploited in the wild, though CVSS 7.1 (network, low complexity, only low privileges required, no user interaction) makes it trivially reachable for anyone with a valid account. Patch to the fixed Langflow release once IBM publishes it; until then, audit which users share FAISS-backed vector stores, review namespace-assignment logic for predictability or reuse, and monitor for accounts querying vector namespaces outside their own project or tenant.

Is CVE-2026-13442 actively exploited?

No confirmed active exploitation of CVE-2026-13442 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13442?

Upgrade to the patched Langflow release as soon as IBM publishes one above 1.10.1. Until patched: enforce per-tenant isolation of FAISS indices at the infrastructure level (separate storage per user/project rather than relying on an app-level namespace string), verify namespace ownership checks are applied server-side on every read/write, and avoid predictable or attacker-influenceable namespace naming schemes. Audit existing multi-user deployments for evidence of namespace collisions or cross-account queries in application logs. If running Langflow as a shared/multi-tenant service, consider temporarily restricting FAISS-backed vector store usage to single-tenant configurations until the fix is deployed.

What systems are affected by CVE-2026-13442?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, agent frameworks, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-13442?

CVE-2026-13442 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesagent frameworksmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0057 LLM Data Leakage

AML.T0064 Gather RAG-Indexed Targets

AML.T0070 RAG Poisoning

AML.T0085.000 RAG Databases

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025, LLM08:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

Exploitation Scenario

An attacker with a low-privileged Langflow account discovers or guesses a FAISS namespace identifier used by another user's project — for example because namespace values are derived from predictable inputs or can be freely set by the client. The attacker configures their own flow to point at that namespace and issues vector-store queries, retrieving chunks of the victim's private document embeddings (internal reports, credentials, customer data) — a straightforward cross-tenant information disclosure requiring no UI interaction. Because the namespace is shared rather than access-controlled, the attacker can also write adversarial vectors into it, so the victim's RAG agent later retrieves and surfaces attacker-planted content in normal conversations — a quiet, persistent integrity attack that resembles hallucination or data drift rather than an obvious breach.

Weaknesses (CWE)

CWE-520 .NET Misconfiguration: Use of Impersonation Primary CWE-520 .NET Misconfiguration: Use of Impersonation

CWE-520 — .NET Misconfiguration: Use of Impersonation: Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.