CVE-2026-17628: Langflow: improper auth allows account password change

MEDIUM

Published September 14, 2026

CISO Take

CVE-2026-17628 is an improper authentication flaw (CWE-287) in IBM Langflow OSS 1.0.0 through 1.10.2 that lets any authenticated low-privilege user change the password of another account, which in practice enables account takeover. The CVSS score is a moderate 5.4, EPSS is low at 0.00336 (roughly the 75th percentile), it is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it TRACK. The real risk is that a takeover of an admin or flow-owner account exposes the LLM API keys, credentials and agent workflows stored in Langflow, which can far exceed what the medium score suggests. Apply the fix described in the IBM advisory (node/7286684) in your next patch cycle, prioritizing instances with multiple users or internet exposure, and review logs for unexpected password-change events.

Sources:NVDEPSSATLASibm.com

What is the risk?

Medium overall. Exploitation is low-complexity over the network, but it requires a valid low-privilege account, there is no user interaction, and no public exploit, scanner template or KEV listing exists. CVSS integrity and availability impact are low, but the practical impact rises if the target account is an administrator or owns flows holding secrets. Multi-tenant or shared Langflow deployments, and any exposed to untrusted users, carry the highest exposure. The downstream dependent count and package risk data are unavailable, so blast radius cannot be quantified.

How does the attack unfold?

Initial Access

Attacker holds or obtains a low-privilege authenticated account on the Langflow instance.

AML.T0012

Exploitation

Attacker sends a crafted password-change request that bypasses proper authentication checks for a target account.

AML.T0049

Credential Access

Attacker logs in as the victim and reads stored API keys and credentials in flows and settings.

AML.T0055

Impact

Attacker modifies agent flows, abuses connected services, or locks out the legitimate user.

Initial Access

Attacker holds or obtains a low-privilege authenticated account on the Langflow instance.

AML.T0012

Exploitation

Attacker sends a crafted password-change request that bypasses proper authentication checks for a target account.

AML.T0049

Credential Access

Attacker logs in as the victim and reads stored API keys and credentials in flows and settings.

AML.T0055

Impact

Attacker modifies agent flows, abuses connected services, or locks out the legitimate user.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 4d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ALow

What should I do?

1 step

1) Upgrade Langflow OSS beyond 1.10.2 as directed in the IBM advisory at https://www.ibm.com/support/pages/node/7286684. 2) Until patched, restrict Langflow access to trusted networks or a VPN and remove unnecessary or stale user accounts. 3) Do not expose Langflow directly to the internet; place it behind an authenticating reverse proxy or SSO. 4) Monitor for password-change events and logins following them, especially on admin accounts. 5) Rotate model-provider, vector DB and other credentials stored in Langflow if suspicious account changes are found.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-17628?

Is CVE-2026-17628 actively exploited?

No confirmed active exploitation of CVE-2026-17628 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17628?

1) Upgrade Langflow OSS beyond 1.10.2 as directed in the IBM advisory at https://www.ibm.com/support/pages/node/7286684. 2) Until patched, restrict Langflow access to trusted networks or a VPN and remove unnecessary or stale user accounts. 3) Do not expose Langflow directly to the internet; place it behind an authenticating reverse proxy or SSO. 4) Monitor for password-change events and logins following them, especially on admin accounts. 5) Rotate model-provider, vector DB and other credentials stored in Langflow if suspicious account changes are found.

What systems are affected by CVE-2026-17628?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM application builders, multi-user AI development environments.

What is the CVSS score for CVE-2026-17628?

CVE-2026-17628 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM application buildersmulti-user AI development environments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

Exploitation Scenario

An attacker obtains or registers a low-privilege account on a shared Langflow instance. They send a crafted request to the password-change endpoint targeting a victim account, such as the administrator, and the flawed authentication check accepts it. They then log in as the victim, extract stored LLM provider API keys and database credentials, and modify agent flows to exfiltrate data or maintain access.

Weaknesses (CWE)

CWE-287Improper Authentication CWE-287Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.