Loading story…
IBM disclosed CVE-2026-19297, a critical authentication weakness in Langflow OSS that allows unlimited login attempts when rate limiting on the POST /api/v1/login endpoint is disabled. The issue maps to CWE-307 (Improper Restriction of Excessive Authentication Attempts) and affects Langflow OSS versions 1.0.0 through 1.9.6. IBM assigned the flaw a CVSS 3.1 score of 9.1, warning that attackers with network access could conduct brute-force or credential-stuffing attacks against exposed instances.
Successful exploitation could compromise user accounts and potentially lead to superuser-level access. IBM said the weakness stems from the LANGFLOW_RATE_LIMIT_ENABLED environment variable, which can disable brute-force protections if not properly validated after deployment. The company recommended upgrading to Langflow OSS 1.10.0 or later and said no workaround or alternative mitigation is available.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 12, 2026, IBM published a security bulletin for CVE-2026-19297, describing insufficient authentication brute-force protection on Langflow OSS's POST /api/v1/login endpoint. IBM assigned the issue a CVSS 3.1 score of 9.1, mapped it to CWE-307, and said no workaround or mitigation is available.
IBM states that Langflow OSS versions 1.0.0 through 1.9.6 are affected and recommends upgrading to version 1.10.0 or newer to remediate the brute-force protection flaw on the login endpoint. A PyPI reference shows Langflow 1.10.0 was published on August 4, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
ibm.com
Open sourcepypi.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-9198** allows unauthenticated remote code execution against default-configured **Langflow OSS** deployments by chaining two exposed API behaviors. According to IBM's security bulletin, the `/api/v1/auto_login` endpoint can issue **SUPERUSER** bearer tokens to any network caller, and the `/api/v1/validate/code` endpoint then executes attacker-controlled Python through `exec()`. IBM said the validator can trigger execution through Python decorators, default arguments, and annotations at function definition time, giving attackers arbitrary command execution on the host. The issue affects Langflow OSS versions **1.0.0 through 1.10.0**, carries a **CVSS 3.1 score of 9.8**, and has no listed workaround. A draft **Metasploit Framework** pull request adds an exploit module for the flaw and says successful exploitation can yield a **Meterpreter** session on vulnerable systems. The module author reported testing against **Langflow 1.8.4 on Ubuntu 22.04**, describing the attack as unauthenticated and effective on default deployments. The pull request also links the bug to **CISA KEV**, underscoring active operational relevance, while IBM advises organizations to upgrade to **Langflow OSS 1.10.1** to remediate the exposure.
Aug 11, 2026
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026
IBM disclosed **CVE-2026-10561**, a critical unauthenticated remote code execution flaw in Langflow OSS affecting versions `1.0.0` through `1.9.3`. The vulnerability is rooted in improper isolation in the `PythonREPLComponent`: CPython's `exec()` restores full builtins access when the globals dictionary does not explicitly clear `__builtins__`, allowing attackers to bypass the intended import restrictions. IBM and downstream advisories rate the issue **CVSS 3.1 10.0**, noting it is remotely exploitable with low attack complexity, requires no privileges, and needs no user interaction. The flaw can be chained with Langflow's default `LANGFLOW_AUTO_LOGIN=true` behavior, which exposes the `/api/v1/auto_login` endpoint and can issue a superuser JWT without credentials, enabling unauthenticated code execution on the host. Successful exploitation could lead to arbitrary OS command execution, theft of LLM provider keys, flow definitions and vector store credentials, and persistent compromise of affected systems. IBM recommends upgrading to **Langflow OSS 1.9.4** immediately; no workaround was listed, and defenders are advised to apply vendor updates, harden access controls, and monitor for unauthorized activity.
Jul 12, 2026