CVE-2026-13444

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7279989	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) IBM Langflow OSS 1.0.0 hasta 1.10.1 puede permitir a un atacante acceder a los documentos vectoriales privados de otro usuario creando su propio flujo con valores coincidentes de persist_directory y collection_name de Chroma. El atacante recibe el contenido exacto de la víctima en la salida de su flujo de trabajo a pesar de no tener autorización para leer el flujo de la víctima. Además, el atacante puede contaminar la colección de la víctima insertando sus propios documentos en el espacio de nombres compartido.

Information

Published : 2026-07-30 19:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-13444

Mitre link : CVE-2026-13444

CVE.ORG link : CVE-2026-13444

JSON object : View

Products Affected

langflow

langflow

CWE

CWE-520

.NET Misconfiguration: Use of Impersonation

{"id": "CVE-2026-13444", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13444", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T19:21:03.779040Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:langflow_oss:1.10.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Langflow OSS", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.10.1"}]}]}], "published": "2026-07-30T19:17:06.997", "references": [{"url": "https://www.ibm.com/support/pages/node/7279989", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-520"}]}], "descriptions": [{"lang": "en", "value": "IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace."}, {"lang": "es", "value": "IBM Langflow OSS 1.0.0 hasta 1.10.1 puede permitir a un atacante acceder a los documentos vectoriales privados de otro usuario creando su propio flujo con valores coincidentes de persist_directory y collection_name de Chroma. El atacante recibe el contenido exacto de la v\u00edctima en la salida de su flujo de trabajo a pesar de no tener autorizaci\u00f3n para leer el flujo de la v\u00edctima. Adem\u00e1s, el atacante puede contaminar la colecci\u00f3n de la v\u00edctima insertando sus propios documentos en el espacio de nombres compartido."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "362B13B6-4992-423F-98D3-60056848503C", "versionEndExcluding": "1.10.2", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}