Loading vulnerability…
Improper access control in IBM Langflow OSS vertex result caching
CVE-2026-97680 is an improper access control vulnerability in the vertex result caching subsystem of IBM Langflow OSS versions 1.0.0 through 1.12.2. A remote authenticated attacker can exploit insufficient access controls to obtain sensitive cached information belonging to other users or inject malicious data into the cache.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality of other users’ sensitive cached information and the integrity of data stored in the vertex result caching subsystem.
If you can’t patch tonight, do this now.
No vendor workaround is identified. Defensive measures include restricting access to caching subsystems, enforcing authorization checks for cached data, and monitoring cache access logs for suspicious activity. These measures are not established substitutes for upgrading.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.3 or later and follow the applicable IBM security bulletin instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.