Loading vulnerability…
User-controlled key authorization bypass in IBM Langflow OSS
CVE-2026-93678 is an improper authorization vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.12.2. Authorization involving a user-controlled key can allow a remote authenticated attacker to obtain sensitive information. The affected function and the specific information exposed are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated remote attacker can bypass authorization restrictions and obtain sensitive information from the vulnerable Langflow OSS deployment. The scope and types of exposed information are not specified.
If you can’t patch tonight, do this now.
No temporary workarounds or mitigations are listed for the affected versions.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.3 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.