Live › vulnerability › CVE-2026-110245
IBM Langflow OSS versions 1.0.0 through 1.12.4 fail to properly check authentication. A remote attacker can obtain sensitive information from an affected instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted Langflow OSS 1.0.0 through 1.12.4 where the instance can be reached over the network. IBM says no login is needed and sensitive information can be read, but does not say which endpoint or data. Instances on 1.12.5 or later can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| langflow | pypi | >= 1.0.0, <= 1.12.4 | 1.12.5 |
pip show langflow (or check the version in the UI)1.0.0 through 1.12.4 are affected; 1.12.5 or later is fixed1.12.5 or later (IBM bulletin 7293016)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-110245")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.