MediumVulnerability
CVE-2026-104314: IBM Langflow OSS exposes stored credentials to flow readers via API
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-104314
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain CVE-2026-104314. An authenticated attacker holding a read or share grant on a target flow can retrieve the flow owner's stored third-party credentials in cleartext from the API response.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-118760: Kubeflow Pipelines artifact routes allow cross-namespace artifact readsSimilar attack · NVD/CVE Database
- InfoA Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication EfficiencySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
- HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSimilar attack · AWS Security Bulletins
- MediumOpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning ProtectionsSimilar attack · The Hacker News
- MediumOpenAI’s August fix for theft of reasoning traces was quickly bypassedSimilar attack · CSO Online