CVE-2026-10128 — Langflow is affected by weaknesses in secret handling and sensitive configuration access

CVE-2026-10128

Langflow is affected by weaknesses in secret handling and sensitive configuration access PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.3

CWE

CWE-200

References

https://www.ibm.com/support/pages/node/7282648

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.