CVE-2026-12945CWE-639

CVE-2026-12945

High · published July 30, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-30T21:16Z
Affected products (1)
ProductVersionsFixed in
langflow/langflow≥ 1.0.0, < 1.10.21.10.2
References (1)
https://www.ibm.com/support/pages/node/7279994 · [email protected]
EPSS history
Timeline
  • 30 JUL 16:44Z
    Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
    cvelistv5