CVE-2026-97680: Langflow: access control flaw in vertex cache leaks data

HIGH

Published October 7, 2026

CISO Take

CVE-2026-97680 is an improper access control flaw (CWE-284) in the vertex result caching subsystem of IBM Langflow OSS 1.0.0 through 1.12.2. Any authenticated low-privilege user can read cached flow results that may contain sensitive data, or inject malicious data into the cache. Exploitation is network-based, low complexity, and needs no user interaction (CVSS 8.3). The EPSS score is low (0.27%, though in the 83rd percentile), and there is no KEV listing, public exploit, or Nuclei template, so mass exploitation is not expected right away. Langflow has a heavy vulnerability history (194 other CVEs in this package), and cache poisoning can alter downstream LLM inputs and outputs, so treat it as a priority for any multi-user or internet-exposed deployment. Upgrade to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694), restrict Langflow access to trusted users, and review who holds accounts on shared instances.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High severity (CVSS 8.3) with a low exploitation barrier: network access, low complexity, low privileges, no user interaction. Real-world likelihood is moderate to low today (EPSS 0.27%, no KEV, no public exploit, no scanner template). Risk grows for multi-tenant or shared Langflow instances, where any low-privilege account can reach other users' cached results. Confidentiality and integrity impact are high; availability impact is low. The attacker needs valid credentials, which limits exposure on single-user, private deployments.

How does the attack unfold?

Initial Access

The attacker authenticates to Langflow with a low-privilege account.

AML.T0012

Exploitation

The attacker sends requests that bypass access control in the vertex result caching subsystem.

AML.T0049

Collection

The attacker reads cached flow results belonging to other users or flows, including sensitive data.

AML.T0036

Impact

The attacker injects malicious data into the cache so that later flow runs consume tampered results.

Initial Access

The attacker authenticates to Langflow with a low-privilege account.

AML.T0012

Exploitation

The attacker sends requests that bypass access control in the vertex result caching subsystem.

AML.T0049

Collection

The attacker reads cached flow results belonging to other users or flows, including sensitive data.

AML.T0036

Impact

The attacker injects malicious data into the cache so that later flow runs consume tampered results.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ALow

What should I do?

7 steps

Upgrade IBM Langflow OSS to the patched release described in IBM's advisory (affected range is 1.0.0 through 1.12.2). The affected-products data lists no patched version, so confirm it in the advisory.
Until patched, limit Langflow access to trusted users, remove unused accounts, and enforce strong authentication and least privilege.
Do not expose Langflow directly to the internet. Place it behind a VPN or an authenticating reverse proxy.
Isolate flows that handle sensitive data into separate instances where feasible.
Clear or flush the vertex cache after patching, since it may hold poisoned entries.
Review access logs for unusual cache-related API calls by low-privilege accounts.
Rotate any secrets or API keys that may have passed through cached results.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassData ExtractionFrameworkRAGAgentAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0070- RAG Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and incidents

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-97680?

Is CVE-2026-97680 actively exploited?

No confirmed active exploitation of CVE-2026-97680 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97680?

1. Upgrade IBM Langflow OSS to the patched release described in IBM's advisory (affected range is 1.0.0 through 1.12.2). The affected-products data lists no patched version, so confirm it in the advisory. 2. Until patched, limit Langflow access to trusted users, remove unused accounts, and enforce strong authentication and least privilege. 3. Do not expose Langflow directly to the internet. Place it behind a VPN or an authenticating reverse proxy. 4. Isolate flows that handle sensitive data into separate instances where feasible. 5. Clear or flush the vertex cache after patching, since it may hold poisoned entries. 6. Review access logs for unusual cache-related API calls by low-privilege accounts. 7. Rotate any secrets or API keys that may have passed through cached results.

What systems are affected by CVE-2026-97680?

This vulnerability affects the following AI/ML architecture patterns: LLM orchestration frameworks, RAG pipelines, agent frameworks, multi-tenant AI workflow platforms.

What is the CVSS score for CVE-2026-97680?

CVE-2026-97680 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

LLM orchestration frameworksRAG pipelinesagent frameworksmulti-tenant AI workflow platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0070RAG Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.

Exploitation Scenario

An attacker gets a low-privilege account on a shared Langflow instance, for example through a self-registered account, a leaked credential, or a compromised contractor login. They call the endpoints that use vertex result caching and reach cached outputs that belong to other users' flows, such as retrieved documents or LLM responses containing sensitive business data. They then write crafted data into the cache. When a privileged user next runs the flow, the poisoned result feeds the downstream LLM or agent components, so the system produces manipulated outputs or follows injected instructions.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.