CVE-2026-18904
Analyzed Analyzed - Analysis Complete

IBM Langflow OSS Namespace Collision Information Disclosure

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-31
Generated
2026-09-18
AI Q&A
2026-08-29
EPSS Evaluated
2026-09-15
NVD
CVE-2026-18904
EUVD
EUVD-2026-67955

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
langflow langflow From 1.0.0 (inc) to 1.11.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.11.1 have a vulnerability where a remote attacker could exploit a namespace collision between user identifiers to gain access to sensitive information or send unauthorized messages.

Detection Guidance

This vulnerability involves namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1. Detection requires inspecting user identifier handling in the application logs and configurations. Check for duplicate or conflicting user IDs in logs and database entries. Monitor for unauthorized message injection attempts in system logs.

Impact Analysis

This vulnerability could allow attackers to steal sensitive data or manipulate messages within the system, potentially leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, which may violate GDPR and HIPAA compliance requirements regarding data protection and confidentiality.

Mitigation Strategies

Update IBM Langflow OSS to a version beyond 1.11.1 to address the namespace collision issue. Monitor network traffic for unauthorized message injection attempts and restrict access to sensitive information until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart