CVE-2026-93678: Langflow: improper authorization exposes sensitive data

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.2 has an improper authorization flaw (CWE-639, authorization bypass through user-controlled key) that lets any authenticated low-privilege user read data they should not be able to access, typically by manipulating object identifiers in requests. The CVSS vector rates integrity impact as high, so unauthorized modification of other users' flows or objects may also be possible. Near-term exploitation risk is modest: EPSS is 0.38% (about the 70th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. However, Langflow has 194 other tracked CVEs and a package risk score of 77/100, and Langflow instances often hold LLM API keys, database credentials and proprietary prompts, so any cross-tenant data exposure is sensitive. Review the IBM advisory (node 7290694) and upgrade beyond 1.12.2 to the fixed release. Until then, restrict Langflow accounts to trusted users and keep the instance off the public internet.

Sources:NVDEPSSibm.comATLAS

What is the risk?

Overall risk is medium-high. The CVSS score of 7.6 reflects network reachability, low complexity, low privileges and no user interaction. Exploitation requires a valid account, which limits the attacker pool, but self-registration or shared multi-user deployments widen it. EPSS (0.00382) and the absence of KEV listing, a public exploit and a scanner template point to low short-term mass exploitation. Langflow's history of 194 CVEs suggests attackers pay attention to this product. Confidence: MEDIUM, because the advisory is terse and the fixed version is not stated in the structured data.

How does the attack unfold?

Initial Access

The attacker authenticates to Langflow with a low-privilege or self-registered account.

AML.T0012

Exploitation

The attacker sends API requests with identifiers of objects owned by other users and bypasses the missing authorization check.

AML.T0049

Collection

The attacker retrieves flows, variables and credentials belonging to other users.

AML.T0036

Impact

Stolen keys and modified flows enable data theft, abuse of LLM and database resources, and tampering with agent logic.

AML.T0048

Initial Access

The attacker authenticates to Langflow with a low-privilege or self-registered account.

AML.T0012

Exploitation

The attacker sends API requests with identifiers of objects owned by other users and bypasses the missing authorization check.

AML.T0049

Collection

The attacker retrieves flows, variables and credentials belonging to other users.

AML.T0036

Impact

Stolen keys and modified flows enable data theft, abuse of LLM and database resources, and tampering with agent logic.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

IHigh

ALow

What should I do?

1 step

1) Upgrade Langflow OSS to the version IBM lists as fixed in advisory 7290694, later than 1.12.2. 2) Until patched, disable open self-registration, limit access to trusted users, and place the instance behind a VPN or an SSO-enforcing reverse proxy. 3) Rotate LLM provider keys, database credentials and any secrets stored in Langflow variables if untrusted users had accounts. 4) Review access logs for authenticated requests where one user accesses object IDs (flows, folders, API keys, messages) they do not own, such as sequential or enumerated IDs. 5) Apply least privilege to credentials used by flows, with scoped keys and spend limits.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAgentAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-93678?

Is CVE-2026-93678 actively exploited?

No confirmed active exploitation of CVE-2026-93678 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93678?

1) Upgrade Langflow OSS to the version IBM lists as fixed in advisory 7290694, later than 1.12.2. 2) Until patched, disable open self-registration, limit access to trusted users, and place the instance behind a VPN or an SSO-enforcing reverse proxy. 3) Rotate LLM provider keys, database credentials and any secrets stored in Langflow variables if untrusted users had accounts. 4) Review access logs for authenticated requests where one user accesses object IDs (flows, folders, API keys, messages) they do not own, such as sequential or enumerated IDs. 5) Apply least privilege to credentials used by flows, with scoped keys and spend limits.

What systems are affected by CVE-2026-93678?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM orchestration platforms, Multi-tenant AI workflow builders.

What is the CVSS score for CVE-2026-93678?

CVE-2026-93678 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM orchestration platformsMulti-tenant AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

Exploitation Scenario

An attacker obtains a low-privilege account on a shared Langflow server, through self-registration, a compromised employee account or a contractor login. They call the API with flow, folder or variable IDs belonging to other users and, because ownership is not checked, retrieve those objects. The responses include flow definitions with embedded API keys, system prompts and connection strings. The attacker uses the stolen keys to reach external LLM providers or internal vector databases, and may modify a victim's flow to change agent behavior.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.