CVE-2026-104314
Awaiting Analysis Awaiting Analysis - Queue

IBM Langflow OSS Credential Exposure via API Response

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-104314
EUVD
EUVD-2026-113147

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IBM Langflow OSS 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.3 allows an authenticated attacker with read or share access to a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response.

Impact Analysis

An attacker could gain access to sensitive third-party credentials, potentially leading to unauthorized access to external systems or data breaches. This could result in data theft, service disruption, or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health information privacy) due to unauthorized exposure of sensitive credentials and potential data breaches. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Update IBM Langflow OSS to version 1.12.4 or later to address the vulnerability. Ensure only authorized users have read or share grants on flows containing third-party credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart