CVE-2026-17628

Received Received - Intake

Remote Authentication Bypass in IBM Langflow OSS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-17628

EUVD

EUVD-2026-77781

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow_oss	From 1.0.0 (inc) to 1.10.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS 1.0.0 through 1.10.2 has an improper authentication vulnerability in the password reset endpoint. The endpoint allows authenticated users to change their password without verifying the current password against stored credentials. This enables changing passwords to weak values, including single-character passwords, without knowing the existing password.

Detection Guidance

Check Langflow OSS versions between 1.0.0 and 1.10.2. Use commands like 'pip show langflow-oss' or 'docker inspect <container>' to verify installed versions. Monitor for unauthorized password changes in logs.

Impact Analysis

An attacker with authenticated access could change account passwords to weak values, enabling brute-force attacks. This could lead to account takeover, unauthorized access, or session compromise. The lack of password complexity enforcement further increases risk of unauthorized access.

Compliance Impact

This vulnerability weakens authentication controls, which may violate compliance requirements for access control and data protection in standards like GDPR and HIPAA. Weak passwords and improper authentication could lead to unauthorized data access, impacting regulatory compliance.

Mitigation Strategies

Upgrade Langflow OSS to version 1.10.3 immediately. Ensure no user accounts have weak passwords set via this vulnerability. Review and enforce password complexity policies.

Hi! I’m here to help you understand CVE-2026-17628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70