Live › vulnerability › CVE-2026-77817
IBM Langflow OSS 1.0.0 through 1.12.4 does not properly sanitize secrets when flows and projects are exported. A remote attacker with a valid account can obtain sensitive information such as credentials stored in exported files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Teams running self-hosted IBM Langflow OSS in the affected range where users with logins can export flows or projects. Exposure depends on whether authenticated users can reach the export feature; the sources do not say more.
No product ranges from the sources yet.
langflow --version or the version pinned in your dependency file, and see whether it falls in 1.0.0 through 1.12.4.1.12.4; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
This page as .md · .json · in your agent: get_signal("CVE-2026-77817")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.