CVE-2026-12945

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7279994	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) IBM Langflow OSS 1.0.0 hasta 1.10.1 permite a usuarios autenticados acceder y manipular los trabajos de compilación de otros usuarios a través de un control de acceso inadecuado en la recuperación de registros y los puntos finales de compilación no autenticados.

Information

Published : 2026-07-30 17:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-12945

Mitre link : CVE-2026-12945

CVE.ORG link : CVE-2026-12945

JSON object : View

Products Affected

langflow

langflow

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-12945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T22:58:57.297039Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:langflow_oss:1.10.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Langflow OSS", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.10.1"}]}]}], "published": "2026-07-30T17:16:28.173", "references": [{"url": "https://www.ibm.com/support/pages/node/7279994", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints."}, {"lang": "es", "value": "IBM Langflow OSS 1.0.0 hasta 1.10.1 permite a usuarios autenticados acceder y manipular los trabajos de compilaci\u00f3n de otros usuarios a trav\u00e9s de un control de acceso inadecuado en la recuperaci\u00f3n de registros y los puntos finales de compilaci\u00f3n no autenticados."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "362B13B6-4992-423F-98D3-60056848503C", "versionEndExcluding": "1.10.2", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}