Loading vulnerability…
Hard-coded Superuser Credentials in IBM Langflow OSS
CVE-2026-13446 is a critical use of hard-coded credentials vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.1. The product contains default superuser credentials that are enforced during startup, including when an operator supplies environment-variable overrides. This permits authentication as a superuser without knowledge of administrator-configured secrets.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can obtain superuser-level access to the affected Langflow OSS instance. The assigned CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), indicating complete compromise of confidentiality, integrity, and availability within the vulnerable service's security authority.
If you can’t patch tonight, do this now.
No vendor-supported workaround or interim mitigation is available. Until the upgrade is completed, restrict network access to Langflow OSS to trusted administrative networks and prevent untrusted users from reaching its authentication interface.
Patch, then assume compromise.
Upgrade Langflow OSS to version 1.10.2, which IBM identifies as the fixed release. Treat any credentials and tokens potentially accessible through the affected deployment as exposed and rotate them after upgrading.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.