CVE-2026-13446CWE-798

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Critical · published July 17, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-07-17T20:43Z
EPSS history
Timeline
  • 17 JUL 20:43Z
    Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
    cvelistv5