CVE-2026-101331

Summary

The flaw allows authenticated attackers to access sensitive information due to insufficiently protected credentials in IBM Langflow OSS versions 1.0.0 through 1.12.2. This means that a logged-in user could potentially extract confidential data that should be restricted.

Exploitability

Exploitation requires an authenticated user account, making it moderately difficult to achieve without prior access, but once inside the system, the attacker can leverage the weak credential protection to extract sensitive information.

Blast radius

If exploited, this vulnerability could lead to unauthorized access to sensitive data and credentials within the Langflow platform, potentially affecting multiple users and their associated confidential information.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to langflow version 1.12.3 or later to address the insufficiently protected credentials issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.