AI Threat AlertCVE-2026-19300: Langflow: leaky credential fields expose secrets
HIGHIBM Langflow OSS versions 1.0.0 through 1.11.2 fail to fully scrub sensitive credential fields, allowing a remote, unauthenticated attacker to retrieve secrets such as API keys or connection strings stored in flow configurations. This matters because Langflow is a visual builder for LLM agent pipelines, so credential fields typically hold live keys for OpenAI, Anthropic, vector databases, or other downstream services — a single disclosure can cascade into unauthorized use of paid AI APIs or lateral access to connected systems. There is no CISA KEV listing, no published EPSS score, and no known public exploit or Nuclei template, so this looks like a disclosed-but-not-yet-weaponized flaw rather than an active campaign; however, the CVSS 7.5 (network, no auth, no user interaction) means exploitation requires minimal attacker effort once a target is identified. Patch to a fixed Langflow release above 1.11.2 as soon as it is available, and in the interim rotate any credentials stored in exposed Langflow instances, restrict network access to the Langflow UI/API, and audit exported flow JSON or logs for unmasked secrets.
What is the risk?
Network-exploitable, unauthenticated, low-complexity information disclosure (CVSS 7.5, C:H/I:N/A:N). No confidentiality-only impact still translates to real risk in AI pipelines because the leaked data is itself credential material that grants further access. No evidence of active exploitation, KEV inclusion, or public PoC/scanner coverage lowers near-term urgency, but the trivial exploitation bar (no privileges, no user interaction) means risk will rise quickly if a PoC surfaces. Exposure is concentrated wherever Langflow instances are internet-reachable or multi-tenant.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Langflow past 1.11.2 once a patched release is confirmed available from IBM/Langflow maintainers. 2) Until patched, restrict network exposure of Langflow (place behind VPN/allowlist, avoid public internet exposure of the UI/API). 3) Rotate all credentials currently stored in Langflow flow configurations (LLM API keys, vector DB tokens, connector secrets) as a precaution. 4) Audit exported flow JSON, backups, and application logs for plaintext or partially-masked credentials that may already have leaked. 5) Enable monitoring/alerting on Langflow API access patterns and unexpected use of the credentials tied to configured integrations (e.g., anomalous OpenAI/Anthropic API usage).
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-19300?
IBM Langflow OSS versions 1.0.0 through 1.11.2 fail to fully scrub sensitive credential fields, allowing a remote, unauthenticated attacker to retrieve secrets such as API keys or connection strings stored in flow configurations. This matters because Langflow is a visual builder for LLM agent pipelines, so credential fields typically hold live keys for OpenAI, Anthropic, vector databases, or other downstream services — a single disclosure can cascade into unauthorized use of paid AI APIs or lateral access to connected systems. There is no CISA KEV listing, no published EPSS score, and no known public exploit or Nuclei template, so this looks like a disclosed-but-not-yet-weaponized flaw rather than an active campaign; however, the CVSS 7.5 (network, no auth, no user interaction) means exploitation requires minimal attacker effort once a target is identified. Patch to a fixed Langflow release above 1.11.2 as soon as it is available, and in the interim rotate any credentials stored in exposed Langflow instances, restrict network access to the Langflow UI/API, and audit exported flow JSON or logs for unmasked secrets.
Is CVE-2026-19300 actively exploited?
No confirmed active exploitation of CVE-2026-19300 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-19300?
1) Upgrade Langflow past 1.11.2 once a patched release is confirmed available from IBM/Langflow maintainers. 2) Until patched, restrict network exposure of Langflow (place behind VPN/allowlist, avoid public internet exposure of the UI/API). 3) Rotate all credentials currently stored in Langflow flow configurations (LLM API keys, vector DB tokens, connector secrets) as a precaution. 4) Audit exported flow JSON, backups, and application logs for plaintext or partially-masked credentials that may already have leaked. 5) Enable monitoring/alerting on Langflow API access patterns and unexpected use of the credentials tied to configured integrations (e.g., anomalous OpenAI/Anthropic API usage).
What systems are affected by CVE-2026-19300?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving.
What is the CVSS score for CVE-2026-19300?
CVE-2026-19300 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.52%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0055Unsecured CredentialsAML.T0083Credentials from AI Agent ConfigurationAML.T0084Discover AI Agent ConfigurationCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
Exploitation Scenario
An attacker scans for internet-facing Langflow instances (a growing target given its popularity for building LLM agent workflows) and sends unauthenticated requests to endpoints that return flow configuration or component details. Due to incomplete scrubbing, the response includes credential fields that were meant to be masked, exposing API keys for the LLM providers or vector databases wired into that flow. The attacker then reuses those keys directly against the provider APIs — running up usage costs, exfiltrating data via the victim's inference quota, or pivoting into connected systems such as a vector database holding proprietary RAG content.
Weaknesses (CWE)
CWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow