CVE-2026-13446

Received Received - Intake

Hard-Coded Credentials in IBM Langflow OSS

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-13446

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow_oss	From 1.0.0 (inc) to 1.10.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials used for authentication, external communication, or data encryption. This means sensitive passwords or keys are embedded in the software, potentially allowing unauthorized access or data exposure.

Detection Guidance

This vulnerability involves hard-coded credentials in IBM Langflow OSS versions 1.0.0 through 1.10.1. Detection requires inspecting configuration files and source code for embedded passwords or keys. Check for default credentials in environment variables, config files, or application logs. Review network traffic for unusual authentication attempts using known hard-coded values.

Impact Analysis

Attackers could exploit hard-coded credentials to gain unauthorized access to systems, intercept communications, or decrypt sensitive data. This may lead to data breaches, system compromise, or unauthorized control over affected environments.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (data security) and HIPAA (protected health information safeguards). Organizations may face penalties for failing to protect credentials and sensitive data.

Mitigation Strategies

Replace hard-coded credentials with secure alternatives like environment variables or secret management tools. Update IBM Langflow OSS to the latest version that removes hard-coded credentials.

Hi! I’m here to help you understand CVE-2026-13446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70