CVE-2026-19875: Langflow missing auth

CISO Take

IBM Langflow's registration endpoint accepts requests without authentication, letting anyone overwrite the platform administrator's email address and hijack the account via password reset — or abuse the instance's SMTP configuration as an open relay for spam and phishing. This affects every Langflow OSS deployment from 1.0.0 through 1.10.0, and the attack requires no credentials, no user interaction, and only network access (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivial to automate at scale against internet-facing instances. There's no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, but Langflow already carries 119 other CVEs and a package risk score of 77/100, reflecting a weak security track record that raises the odds this gets weaponized quickly once attackers notice the pattern. Full admin takeover of a Langflow instance means control over every connected AI workflow, stored API key, and tool integration configured in it — a serious blast radius for any team using it to orchestrate LLM pipelines. Patch to the fixed release referenced in IBM's advisory immediately, and until then restrict network access to the Langflow admin and registration endpoints to trusted IPs/VPN, rotate credentials stored in flows, and monitor outbound SMTP traffic from the host for relay abuse.

Sources:NVDCISA KEVibm.comATLAS

What is the risk?

Exploitability is high: the flaw requires no authentication, no user interaction, and only low-complexity network access, so it can be scanned and exploited at internet scale with simple automation. Impact per CVSS is integrity-only (C:N/I:H/A:N), but the real-world consequence — full administrative account takeover — cascades far beyond the formal score, since Langflow admins control every stored credential, connected LLM API key, and executable flow on the instance. Exposure is elevated by Langflow's poor security track record (119 other CVEs, package risk score 77/100) and by the fact that AI orchestration platforms like this are increasingly deployed with broad network access and privileged integrations. No active exploitation, KEV listing, or public PoC/scanner exists yet, which lowers immediate urgency but should not be read as low risk given how trivial the exploit path is.

How does the attack unfold?

Initial Access

Attacker locates an internet-exposed Langflow instance and sends an unauthenticated request to its registration endpoint.

AML.T0049

Exploitation

The request overwrites the stored administrator email address due to the missing authentication check on this endpoint.

Account Takeover

Attacker triggers a password reset to the newly assigned email and logs in with full administrator privileges.

AML.T0012

Impact

Attacker gains control over connected AI workflows and stored credentials, and can abuse the server's SMTP configuration as an outbound relay for spam and phishing.

Initial Access

Attacker locates an internet-exposed Langflow instance and sends an unauthenticated request to its registration endpoint.

AML.T0049

Exploitation

The request overwrites the stored administrator email address due to the missing authentication check on this endpoint.

Account Takeover

Attacker triggers a password reset to the newly assigned email and logs in with full administrator privileges.

AML.T0012

Impact

Attacker gains control over connected AI workflows and stored credentials, and can abuse the server's SMTP configuration as an outbound relay for spam and phishing.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 4d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

Patch to the fixed Langflow release referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7283810) immediately. Until patched, do not expose the Langflow registration or admin endpoints directly to the internet — place the instance behind a VPN, IP allowlist, or authenticating reverse proxy. Rotate the admin password and any API keys/credentials stored in flows if the instance has ever been internet-facing. Audit logs for unexpected changes to the admin email/user records, and monitor outbound SMTP volume from the host for signs of relay abuse. Where possible, front the instance with SSO/MFA rather than relying on Langflow's native registration flow.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-Security controls for AI systems

NIST AI RMF

MANAGE-4.1-AI risks and benefits are monitored and post-deployment risk management activities are performed

Frequently Asked Questions

What is CVE-2026-19875?

IBM Langflow's registration endpoint accepts requests without authentication, letting anyone overwrite the platform administrator's email address and hijack the account via password reset — or abuse the instance's SMTP configuration as an open relay for spam and phishing. This affects every Langflow OSS deployment from 1.0.0 through 1.10.0, and the attack requires no credentials, no user interaction, and only network access (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivial to automate at scale against internet-facing instances. There's no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, but Langflow already carries 119 other CVEs and a package risk score of 77/100, reflecting a weak security track record that raises the odds this gets weaponized quickly once attackers notice the pattern. Full admin takeover of a Langflow instance means control over every connected AI workflow, stored API key, and tool integration configured in it — a serious blast radius for any team using it to orchestrate LLM pipelines. Patch to the fixed release referenced in IBM's advisory immediately, and until then restrict network access to the Langflow admin and registration endpoints to trusted IPs/VPN, rotate credentials stored in flows, and monitor outbound SMTP traffic from the host for relay abuse.

Is CVE-2026-19875 actively exploited?

No confirmed active exploitation of CVE-2026-19875 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19875?

Patch to the fixed Langflow release referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7283810) immediately. Until patched, do not expose the Langflow registration or admin endpoints directly to the internet — place the instance behind a VPN, IP allowlist, or authenticating reverse proxy. Rotate the admin password and any API keys/credentials stored in flows if the instance has ever been internet-facing. Audit logs for unexpected changes to the admin email/user records, and monitor outbound SMTP volume from the host for signs of relay abuse. Where possible, front the instance with SSO/MFA rather than relying on Langflow's native registration flow.

What systems are affected by CVE-2026-19875?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-19875?

CVE-2026-19875 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.

Exploitation Scenario

An attacker scans the internet for exposed Langflow instances, identifies one running a vulnerable version (1.0.0–1.10.0), and sends an unauthenticated request to the registration endpoint that overwrites the stored administrator email with an attacker-controlled address. The attacker then triggers the 'forgot password' flow, receives the reset link at their own inbox, and logs in with full administrator privileges. From there they can exfiltrate API keys embedded in flows, tamper with production AI workflows, or repurpose the instance's outbound mail configuration to blast phishing emails that appear to originate from the victim's trusted domain.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-306Missing Authentication for Critical Functionality

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.