CVE-2026-93677: Langflow: info disclosure lets authed users read sensitive data

MEDIUM

Published October 7, 2026

CISO Take

CVE-2026-93677 is an information exposure flaw (CWE-200) in IBM's Langflow OSS 1.0.0 through 1.12.2 that lets any low-privileged authenticated user over the network read sensitive data they should not see. The scope-changed CVSS vector (S:C, C:H) signals that the leak crosses a security boundary, which in Langflow deployments typically means stored API keys, model provider credentials, or other users' flows and variables. Near-term exploitation risk is moderate to low: EPSS is 0.46% (62nd percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, but Langflow has 194 other CVEs and a 77/100 package risk score, so it is a well-scrutinized and historically attacked target. Upgrade beyond 1.12.2 per the IBM advisory (https://www.ibm.com/support/pages/node/7290694), restrict Langflow to trusted networks and users, and rotate any credentials stored in Langflow if untrusted users had accounts.

Sources:NVDEPSSATLASibm.com

What is the risk?

Medium-high. The CVSS score of 7.7 reflects low attack complexity, network reach, no user interaction, and high confidentiality impact with changed scope. Exploitation requires a valid account, which lowers exposure for single-tenant or internal deployments but matters for multi-user or self-registration setups. Real-world exploitation likelihood is currently low (EPSS 0.0046, no KEV listing, no public exploit or scanner template). The patched version is not stated in the structured data, so confirm it in the IBM advisory. The package's history of 194 CVEs raises the likelihood that researchers and attackers will probe this area.

How does the attack unfold?

Initial Access

Attacker obtains or registers a low-privileged account on a reachable Langflow instance.

AML.T0012

Exploitation

Attacker sends crafted authenticated requests to the vulnerable endpoint that returns data beyond their authorization.

AML.T0036

Credential Harvesting

Attacker collects exposed secrets such as LLM provider keys and database connection strings.

AML.T0055

Impact

Attacker reuses stolen credentials to access model providers, vector stores, and connected data sources.

Initial Access

Attacker obtains or registers a low-privileged account on a reachable Langflow instance.

AML.T0012

Exploitation

Attacker sends crafted authenticated requests to the vulnerable endpoint that returns data beyond their authorization.

AML.T0036

Credential Harvesting

Attacker collects exposed secrets such as LLM provider keys and database connection strings.

AML.T0055

Impact

Attacker reuses stolen credentials to access model providers, vector stores, and connected data sources.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to a version later than 1.12.2 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7290694. 2) Until patched, limit access to trusted users, disable open self-registration, and keep instances off the public internet or behind SSO/VPN. 3) Rotate LLM provider keys, vector DB credentials, and any secrets stored in Langflow variables or flows if untrusted accounts have had access. 4) Move secrets to an external secrets manager rather than storing them in flow definitions. 5) Review Langflow API access logs for unusual enumeration or bulk reads by low-privileged accounts, and monitor provider usage for anomalous API key use.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionFrameworkAgentAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM02:2025-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-93677?

Is CVE-2026-93677 actively exploited?

No confirmed active exploitation of CVE-2026-93677 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93677?

1) Upgrade Langflow OSS to a version later than 1.12.2 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7290694. 2) Until patched, limit access to trusted users, disable open self-registration, and keep instances off the public internet or behind SSO/VPN. 3) Rotate LLM provider keys, vector DB credentials, and any secrets stored in Langflow variables or flows if untrusted accounts have had access. 4) Move secrets to an external secrets manager rather than storing them in flow definitions. 5) Review Langflow API access logs for unusual enumeration or bulk reads by low-privileged accounts, and monitor provider usage for anomalous API key use.

What systems are affected by CVE-2026-93677?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow orchestration, RAG pipelines, multi-tenant LLM platforms.

What is the CVSS score for CVE-2026-93677?

CVE-2026-93677 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM workflow orchestrationRAG pipelinesmulti-tenant LLM platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.

Exploitation Scenario

An attacker obtains or registers a low-privileged account on an internet-reachable or shared Langflow instance. They call the vulnerable API endpoint over the network and retrieve sensitive information they are not authorized to see, such as stored API keys, connection strings, or other users' flow configurations. They then use the harvested provider keys to access the organization's LLM accounts and vector databases, or to run up costs and extract proprietary data. The specific vulnerable endpoint is not disclosed in the public data, so this scenario is inferred from the CWE-200 classification and the scope-changed CVSS vector.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.