AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

CVE-2026-12945: IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs throug

highvulnerability

security

Source: NVD/CVE DatabaseJuly 30, 2026CVE-2026-12945

Summary

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a security flaw where authenticated users (those with login credentials) can view and change other users' build jobs because certain endpoints lack proper access control checks. This happens through improper authorization on log retrieval and unauthenticated build endpoints (entry points that don't require login verification).

Vulnerability Details

CVSS Score

7.1(high)

EPSS (30-day exploit probability)

EPSS: 0.0%

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector

network

Attack Complexity

low

Privileges Required

low

User Interaction

none

Disclosure Date

July 30, 2026

Classification

Attack Type

Other

Attack SophisticationTrivial

Impact (CIA+S)

confidentialityintegrity

Taxonomy References

CWE (Weakness Type)

CWE-639

Affected Vendors

LangChain

Related Issues

medium

CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e

Same vendorNVD/CVE Database

critical

CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-

Same vendor

Monthly digest — independent AI security research

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12945

First tracked: July 30, 2026 at 02:08 PM

Classified by LLM (prompt v3) · confidence: 85%