CVE-2026-102590: IBM Langflow OSS (High, CVSS 7.7)

CVE record · updated Oct 30, 2026

CVE-2026-102590HighIBM Langflow OSS

CVSS: 7.7 High (v3.1)
EPSS: 0.2% chance of exploitation in the next 30 days (higher than 15.1% of CVEs)
Exploited in the wild: Not on CISA’s KEV list
Public exploit: None reported in public exploit databases
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Published: Oct 29, 2026

What it is

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

Description from the National Vulnerability Database.

What to do

Check whether you run IBM Langflow OSS, then apply the vendor’s fix or mitigation from the advisories below.

Advisories and fixes

www.ibm.com Patch · Vendor Advisory

Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.