AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

CVE-2026-10700: IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API th

mediumvulnerability

security

Source: NVD/CVE DatabaseJuly 30, 2026CVE-2026-10700

Summary

IBM Langflow OSS versions 1.0.0 through 1.8.4 have broken access control vulnerabilities in its file handling API (a set of tools that lets software request files). One endpoint allows anyone to download image files without logging in, while another endpoint lets logged-in users access files belonging to other users by guessing file identifiers, potentially exposing sensitive data across multiple users.

Vulnerability Details

CVSS Score

6.5(medium)

EPSS (30-day exploit probability)

EPSS: 0.0%

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

network

Attack Complexity

low

Privileges Required

low

User Interaction

none

Disclosure Date

July 30, 2026

Classification

Attack Type

Data Extraction

Attack SophisticationTrivial

Impact (CIA+S)

confidentialityintegrity

Taxonomy References

CWE (Weakness Type)

CWE-639

Affected Vendors

LangChain

Related Issues

medium

CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e

Same vendorNVD/CVE Database

critical

CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-

Same vendor

Monthly digest — independent AI security research

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-10700

First tracked: July 31, 2026 at 02:07 AM

Classified by LLM (prompt v3) · confidence: 95%