Vulnerabilities

TI-2026-10911 CVE-2026-12763 · GHSA-vhrg-69rg-gwv4

Langflow is vulnerable to authentication bypass and insufficient session expiration

LOW 19

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00188 Published 2026-09-14 No fix listed CWE-306

TI-2026-56107 CVE-2026-81268 · GHSA-2fpx-w7mw-jhxj

Langflow is vulnerable to authentication bypass and insufficient session expiration

LOW 38

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00433 Published 2026-09-10 No fix listed CWE-613

Vulnerabilities

Filters

Langflow is vulnerable to authentication bypass and insufficient session expiration

Langflow is vulnerable to authentication bypass and insufficient session expiration