AI Threat AlertCVE-2026-19297: Langflow: missing login rate limiting enables account takeover
CRITICALCISA: TRACK*Langflow OSS versions 1.0.0 through 1.9.6 do not limit repeated authentication attempts (CWE-307), so a remote, unauthenticated attacker can brute-force or credential-stuff user accounts over the network with no user interaction. The CVSS is 9.1 (critical), but the practical urgency is moderate: EPSS is 0.6% (around the 53rd percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it TRACK*. The real exposure is any internet-reachable Langflow instance, because a taken-over account exposes flows, stored API keys and connected data sources, and the package has 194 other CVEs, which signals a weak security track record. Check IBM's advisory (ibm.com/support/pages/node/7283558) for the fixed version and upgrade past 1.9.6, and until then put Langflow behind a VPN or SSO-enforcing reverse proxy with rate limiting and enforce strong, unique passwords.
What is the risk?
Technical severity is high: network-reachable, low complexity, no privileges or user interaction, with high confidentiality and integrity impact (CVSS 9.1). Exploitation likelihood is currently low to moderate: EPSS 0.00607, not in KEV, no public exploit or scanner template, SSVC TRACK*. Brute-force tooling is generic and trivial to apply, so weaponization needs no vulnerability-specific research. Risk depends mostly on exposure and password strength: internet-facing instances with weak or reused passwords are at highest risk, while instances behind SSO, VPN or an upstream rate-limiting proxy are largely mitigated. Confidence: MEDIUM, because the description is brief and the affected and patched version ranges are not structured in the data.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Langflow to the fixed release named in IBM's advisory (https://www.ibm.com/support/pages/node/7283558); versions 1.0.0 to 1.9.6 are affected. 2) Do not expose Langflow directly to the internet; place it behind a VPN, zero-trust gateway or SSO-enabled reverse proxy. 3) Add rate limiting, IP throttling and account lockout at the reverse proxy or WAF on login endpoints. 4) Enforce strong, unique passwords and MFA through the upstream identity provider. 5) Detection: alert on bursts of failed logins, many failed attempts across accounts from one source (credential stuffing), and successful logins following failures or from new geographies. 6) If suspicious activity is found, rotate all API keys and secrets stored in Langflow, review flows for unexpected components or custom code, and reset affected passwords.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-19297?
Langflow OSS versions 1.0.0 through 1.9.6 do not limit repeated authentication attempts (CWE-307), so a remote, unauthenticated attacker can brute-force or credential-stuff user accounts over the network with no user interaction. The CVSS is 9.1 (critical), but the practical urgency is moderate: EPSS is 0.6% (around the 53rd percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it TRACK*. The real exposure is any internet-reachable Langflow instance, because a taken-over account exposes flows, stored API keys and connected data sources, and the package has 194 other CVEs, which signals a weak security track record. Check IBM's advisory (ibm.com/support/pages/node/7283558) for the fixed version and upgrade past 1.9.6, and until then put Langflow behind a VPN or SSO-enforcing reverse proxy with rate limiting and enforce strong, unique passwords.
Is CVE-2026-19297 actively exploited?
No confirmed active exploitation of CVE-2026-19297 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-19297?
1) Upgrade Langflow to the fixed release named in IBM's advisory (https://www.ibm.com/support/pages/node/7283558); versions 1.0.0 to 1.9.6 are affected. 2) Do not expose Langflow directly to the internet; place it behind a VPN, zero-trust gateway or SSO-enabled reverse proxy. 3) Add rate limiting, IP throttling and account lockout at the reverse proxy or WAF on login endpoints. 4) Enforce strong, unique passwords and MFA through the upstream identity provider. 5) Detection: alert on bursts of failed logins, many failed attempts across accounts from one source (credential stuffing), and successful logins following failures or from new geographies. 6) If suspicious activity is found, rotate all API keys and secrets stored in Langflow, review flows for unexpected components or custom code, and reset affected passwords.
What systems are affected by CVE-2026-19297?
This vulnerability affects the following AI/ML architecture patterns: LLM application frameworks, agent frameworks, RAG pipelines, low-code AI workflow builders.
What is the CVSS score for CVE-2026-19297?
CVE-2026-19297 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.61%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationAML.T0055Unsecured CredentialsCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
Exploitation Scenario
An attacker finds an internet-exposed Langflow instance through Shodan or Censys. Using a leaked-credential list or a common-password dictionary, they run an automated attack against the login endpoint, which has no lockout or throttling. After a successful guess, they log in as a legitimate user, extract stored LLM provider keys and vector database credentials from flows and variables, and modify a production agent flow to exfiltrate user prompts and retrieved data to an external endpoint. They may also add a custom code component to gain a foothold on the host.
Weaknesses (CWE)
CWE-307Improper Restriction of Excessive Authentication AttemptsPrimaryCWE-307Improper Restriction of Excessive Authentication AttemptsCWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
- [Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow