CVE-2026-13446: Langflow hard-coded credentials

CISO Take

IBM Langflow — the open-source visual framework used to build LLM and agent pipelines — ships with hard-coded credentials baked into its authentication, outbound-communication, and internal encryption logic, meaning every deployment of versions 1.0.0 through 1.10.1 shares the same secret regardless of who installs it. With a 9.8 CVSS score, network-level exploitability, and zero privileges or user interaction required, anyone who extracts the fixed credential from Langflow's public source or binaries can authenticate to any exposed instance as a legitimate user or service. There is no CISA KEV listing, EPSS score, or public exploit/scanner yet, so mass opportunistic exploitation hasn't been confirmed — but the bar to weaponize is trivial once the credential is known, and Langflow's track record of prior RCE-class CVEs makes it an already-targeted platform for internet scanning. CISOs running Langflow should treat any internet-facing instance as compromised-by-default until patched: upgrade past 1.10.1, rotate every secret, API key, and encrypted value stored inside affected instances, and restrict access behind an authenticating reverse proxy or VPN in the meantime.

Sources: NVD ATLAS ibm.com

What is the risk?

Critical. The flaw combines the maximum practical exploitability profile (network vector, low attack complexity, no privileges, no user interaction) with a vulnerability class — hard-coded credentials (CWE-798) — that requires no AI/ML-specific expertise to abuse once the value is known, since it is identical across all vulnerable deployments. The absence of an EPSS score and CISA KEV listing indicates exploitation has not yet been observed in the wild, and no public PoC or Nuclei template currently exists, which lowers near-term likelihood relative to the theoretical severity. However, because the credential is static and shared across every install of the affected version range, the effective barrier to exploitation collapses to zero the moment the value circulates (source review, binary extraction, or vendor advisory reverse-engineering), making this a latent critical risk that can flip to active exploitation with no warning.

How does the attack unfold?

Initial Access

Attacker locates an internet-facing Langflow instance and obtains the hard-coded credential from Langflow's public source code or distributed binaries.

AML.T0049

Credential-Based Authentication

Attacker uses the universal hard-coded credential to authenticate to the instance's backend/API without needing a unique, target-specific account.

AML.T0012

Flow Manipulation

With authenticated access, the attacker views or modifies flows and invokes custom components to execute arbitrary code or harvest embedded secrets.

AML.T0050

Data Exfiltration & Pivot

Attacker exfiltrates harvested API keys and proprietary data and pivots into connected LLM providers or internal systems using the stolen credentials.

AML.T0025

Initial Access

Attacker locates an internet-facing Langflow instance and obtains the hard-coded credential from Langflow's public source code or distributed binaries.

AML.T0049

Credential-Based Authentication

Attacker uses the universal hard-coded credential to authenticate to the instance's backend/API without needing a unique, target-specific account.

AML.T0012

Flow Manipulation

With authenticated access, the attacker views or modifies flows and invokes custom components to execute arbitrary code or harvest embedded secrets.

AML.T0050

Data Exfiltration & Pivot

Attacker exfiltrates harvested API keys and proprietary data and pivots into connected LLM providers or internal systems using the stolen credentials.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.9K Pushed 2d ago 20% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow past version 1.10.1 to the vendor-patched release referenced in IBM's advisory (support.ibm.com/pages/node/7279991) as soon as it is available/confirmed. 2) Treat the hard-coded credential as fully disclosed: rotate every secret, API key, and encryption key stored in or accessible from any Langflow instance, patched or not. 3) Remove direct internet exposure — place Langflow behind a VPN, IP allowlist, or authenticating reverse proxy rather than relying on its own auth. 4) Audit Langflow instance logs for authentication events using default/known credential patterns and for unexpected flow modifications. 5) Inventory all Langflow deployments (shadow-IT risk is high for low-code AI tools) before assuming remediation is complete.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Framework Agent AML.T0010.001 - AI Software AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system development lifecycle - secure design and verification

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-13446?

IBM Langflow — the open-source visual framework used to build LLM and agent pipelines — ships with hard-coded credentials baked into its authentication, outbound-communication, and internal encryption logic, meaning every deployment of versions 1.0.0 through 1.10.1 shares the same secret regardless of who installs it. With a 9.8 CVSS score, network-level exploitability, and zero privileges or user interaction required, anyone who extracts the fixed credential from Langflow's public source or binaries can authenticate to any exposed instance as a legitimate user or service. There is no CISA KEV listing, EPSS score, or public exploit/scanner yet, so mass opportunistic exploitation hasn't been confirmed — but the bar to weaponize is trivial once the credential is known, and Langflow's track record of prior RCE-class CVEs makes it an already-targeted platform for internet scanning. CISOs running Langflow should treat any internet-facing instance as compromised-by-default until patched: upgrade past 1.10.1, rotate every secret, API key, and encrypted value stored inside affected instances, and restrict access behind an authenticating reverse proxy or VPN in the meantime.

Is CVE-2026-13446 actively exploited?

No confirmed active exploitation of CVE-2026-13446 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13446?

1) Upgrade Langflow past version 1.10.1 to the vendor-patched release referenced in IBM's advisory (support.ibm.com/pages/node/7279991) as soon as it is available/confirmed. 2) Treat the hard-coded credential as fully disclosed: rotate every secret, API key, and encryption key stored in or accessible from any Langflow instance, patched or not. 3) Remove direct internet exposure — place Langflow behind a VPN, IP allowlist, or authenticating reverse proxy rather than relying on its own auth. 4) Audit Langflow instance logs for authentication events using default/known credential patterns and for unexpected flow modifications. 5) Inventory all Langflow deployments (shadow-IT risk is high for low-code AI tools) before assuming remediation is complete.

What systems are affected by CVE-2026-13446?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2026-13446?

CVE-2026-13446 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Exploitation Scenario

An attacker identifies an internet-facing Langflow instance via routine scanning of exposed AI/ML tooling (a growing target category given Langflow's prior RCE history). Having obtained the hard-coded credential from Langflow's open-source codebase or a leaked build artifact, the attacker authenticates directly to the instance's API without needing any target-specific compromise. Once inside, they enumerate existing flows to harvest embedded API keys and connection strings for downstream LLM providers, vector databases, or internal systems, and optionally modify a flow to add a malicious custom component that executes arbitrary code on the host. The attacker then pivots using the harvested credentials to access the organization's actual LLM provider accounts or internal data sources, exfiltrating proprietary prompts, RAG-indexed data, or paid API quota — all without triggering any authentication anomaly, since the credential used is the one Langflow itself considers valid.

Weaknesses (CWE)

CWE-798 Use of Hard-coded Credentials Primary CWE-798 Use of Hard-coded Credentials

CWE-798 — Use of Hard-coded Credentials: The product contains hard-coded credentials, such as a password or cryptographic key.

[Architecture and Design] For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7]. In Windows environments, the Encrypted File System (EFS) may provide some protection.
[Architecture and Design] For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.

Source: MITRE CWE corpus.