CVE-2026-13442
Received Received - Intake

IBM Langflow OSS Vector Namespace Reuse Vulnerability

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-13442

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm langflow_oss From 1.0.0 (inc) to 1.10.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-520 Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an attacker to reuse another user's FAISS namespace. This leads to access of owner-only vector content and manipulation of query results, causing cross-user information disclosure and limited integrity impact through persistent result poisoning.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to FAISS namespaces in IBM Langflow OSS. Monitor logs for unusual vector content access patterns or query result manipulations. Review user permissions and namespace assignments for inconsistencies.

Impact Analysis

An attacker could access your private vector data stored in FAISS namespaces and alter query results, leading to unauthorized information exposure and potentially skewed outputs from the system.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance penalties, and loss of trust due to information disclosure.

Mitigation Strategies
  • Upgrade IBM Langflow OSS to the latest version beyond 1.10.1 to patch the vulnerability.
  • Audit and restrict user permissions to prevent unauthorized namespace access.
  • Review and reset FAISS namespaces to ensure no persistent poisoning exists.
  • Monitor query results for signs of tampering or unauthorized data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13442. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart