{"id":"CVE-2026-101331","published":"2026-10-07T01:16:33.957","lastModified":"2026-10-08T18:16:35.340","description":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-522"],"vendors":["langflow"],"products":["langflow"],"references":[{"url":"https://www.ibm.com/support/pages/node/7290694","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated attackers to access sensitive information due to insufficiently protected credentials in IBM Langflow OSS versions 1.0.0 through 1.12.2. This means that a logged-in user could potentially extract confidential data that should be restricted.","exploitability":"Exploitation requires an authenticated user account, making it moderately difficult to achieve without prior access, but once inside the system, the attacker can leverage the weak credential protection to extract sensitive information.","blast_radius":"If exploited, this vulnerability could lead to unauthorized access to sensitive data and credentials within the Langflow platform, potentially affecting multiple users and their associated confidential information.","remediation":"Upgrade to langflow version 1.12.3 or later to address the insufficiently protected credentials issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["information-disclosure","credential-management","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:00:09.084Z"}}