CVE-2026-13446: IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it
Summary
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or encryption keys built directly into the code), which the software uses for its own authentication, communication with external systems, and data encryption. This vulnerability allows attackers to potentially gain unauthorized access or compromise the security of systems using these versions.
Vulnerability Details
9.8(critical)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
network
low
none
none
July 17, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-13446
First tracked: July 17, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 92%