{"data":{"id":"3094c833-8c80-4279-b06c-3cb3e8c6d1d3","title":"CVE-2026-10134: IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…","summary":"CVE-2026-10134 affects IBM Langflow OSS 1.0.0 through 1.9.3. An attacker can read every secret available to the Langflow process and read and modify every flow, conversation, message, file upload and saved component in the Langflow database. The source also says an attacker can connect to internal services, abuse cloud metadata endpoints, move laterally to other tenants on the same instance, and establish persistence by modifying a public flow's `tool_code`, so that normal `/api/v1/build/...` calls re-execute attacker code.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10134","publishedAt":"2026-06-30T20:17:26.883Z","cveId":"CVE-2026-10134","cweIds":["CWE-94"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS secret exposure and code execution via flow build endpoints","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00641,"epssCheckedAt":"2026-10-14T06:09:05.894Z","kevDateAdded":null,"advisoryAliases":["GHSA-mgqp-4wrr-7886"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:17.132Z","patchAvailable":null,"disclosureDate":"2026-06-30T20:17:26.883Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}