CVE-2026-77817: Langflow: secrets exposed in flow/project exports

MEDIUM

Published October 29, 2026

CISO Take

CVE-2026-77817 is an information disclosure flaw in IBM Langflow OSS 1.0.0 through 1.12.4: secrets are not properly sanitized when flows and projects are exported, so any authenticated user who can export can obtain credentials embedded in them. Langflow flows commonly hold LLM provider API keys, vector database credentials and third-party tool tokens, so one leaked export can open up many connected systems. The rating is medium (CVSS 6.5), and the confidentiality impact is high. The CVE is not in CISA KEV, there is no public exploit or Nuclei template, and EPSS data is not yet available, so there is no sign of active exploitation. Upgrade to the fixed version listed in the IBM advisory (node 7293016), rotate every secret stored in Langflow flows, and review who holds export permissions.

Sources:NVDibm.comATLAS

What is the risk?

Medium overall. It is exploitable over the network with low complexity and no user interaction, but it needs a low-privileged authenticated account. Only confidentiality is affected (C:H, I:N, A:N). Real-world risk depends on what is in the flows: multi-user or shared Langflow instances, where many people hold accounts, carry the most risk, and a single-user instance carries little. A leaked key can lead to downstream compromise that goes well beyond the CVSS score. There is no evidence of exploitation, a public exploit or KEV listing at this time.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privileged account on a Langflow instance.

AML.T0012

Collection

Attacker uses the flow or project export feature to download definitions containing unsanitized secrets.

AML.T0055

Credential Access

Attacker extracts API keys and credentials from the exported files.

AML.T0083

Impact

Attacker misuses the stolen keys to access LLM providers, data stores and connected services.

Initial Access

Attacker authenticates with a low-privileged account on a Langflow instance.

AML.T0012

Collection

Attacker uses the flow or project export feature to download definitions containing unsanitized secrets.

AML.T0055

Credential Access

Attacker extracts API keys and credentials from the exported files.

AML.T0083

Impact

Attacker misuses the stolen keys to access LLM providers, data stores and connected services.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

6 steps

Upgrade Langflow to the fixed release described in the IBM advisory (https://www.ibm.com/support/pages/node/7293016).
Rotate all API keys, tokens and database credentials stored in flows or projects, especially any that were ever exported.
Move secrets to environment variables or a secrets manager, using global variables instead of hardcoded values in flow components.
Limit export permissions and remove unneeded low-privilege accounts.
Audit export activity in logs and search repositories, shared drives and tickets for previously exported flow JSON files containing credentials.
Watch provider usage and billing for anomalous activity from leaked keys.

How is it classified?

Data LeakageData ExtractionFrameworkAgentAML.T0012- Valid Accounts AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Security of AI system information and data

NIST AI RMF

MANAGE 2.3-Risk treatment and response to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-77817?

Is CVE-2026-77817 actively exploited?

No confirmed active exploitation of CVE-2026-77817 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77817?

1. Upgrade Langflow to the fixed release described in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). 2. Rotate all API keys, tokens and database credentials stored in flows or projects, especially any that were ever exported. 3. Move secrets to environment variables or a secrets manager, using global variables instead of hardcoded values in flow components. 4. Limit export permissions and remove unneeded low-privilege accounts. 5. Audit export activity in logs and search repositories, shared drives and tickets for previously exported flow JSON files containing credentials. 6. Watch provider usage and billing for anomalous activity from leaked keys.

What systems are affected by CVE-2026-77817?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM orchestration platforms, Low-code AI workflow builders.

What is the CVSS score for CVE-2026-77817?

CVE-2026-77817 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM orchestration platformsLow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.

Exploitation Scenario

An attacker gets a low-privileged account on a shared Langflow instance, for example a contractor or a compromised user. They use the flow or project export feature to download the definitions of high-value flows. Because secrets are not properly sanitized, the exported files contain LLM provider API keys and vector database credentials. The attacker then uses these outside Langflow to run up inference costs, read RAG knowledge bases, and pivot into connected services.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.