CVE-2026-10128 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. Authenticated users can leverage a built-in Langflow component to read arbitrary server environment variables, bypassing security controls intended to disable custom components. This results in exposure of sensitive information, such as secrets stored in environment variables. The vulnerability does not require user interaction and has a low attack complexity but requires privileges to authenticate. The impact is confidentiality loss without affecting integrity or availability.

The vulnerability allows an authenticated user to access sensitive environment variables on the server, potentially exposing secrets such as credentials or API keys. This could lead to further compromise if the exposed secrets are used in other parts of the system or infrastructure. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to environment variable access.