CVE-2026-10128: IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbit

IBM Langflow OSS (an open-source framework for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where authenticated users (people already logged in) can exploit a built-in component to read arbitrary server environment variables (configuration settings stored on the server), potentially exposing sensitive secrets even when security controls are meant to prevent this. This is classified as CWE-200 (exposure of sensitive information to an unauthorized actor).