CVE-2026-13446: falha crítica em IBM Langflow OSS
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.4%
IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
IBM · Langflow OSSCVEs relacionadas — IBM Langflow OSS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-9198CRITICALUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationEPSS 28.7%KEVCVE-2026-93674CRITICALLangflow OSS is affected by multiple vulnerabilitiesEPSS 15.3%CVE-2026-7873CRITICALCode Injection Vulnerability in Code Validation EndpointEPSS 6.2%CVE-2026-9103CRITICALUnauthenticated Superuser Token Issuance via Auto-Login EndpointEPSS 3.2%CVE-2026-10134CRITICALUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsEPSS 2.3%CVE-2026-93680CRITICALLangflow OSS is affected by multiple vulnerabilitiesEPSS 2.2%