CVE-2026-10128 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. Authenticated users can leverage a built-in Langflow component to read arbitrary server environment variables, which may contain sensitive secrets. This occurs despite existing security controls designed to disable custom components, leading to unintended exposure of sensitive information. The vulnerability is categorized under CWE-200 and has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official remediation or patch information is provided in the available data.

The vulnerability allows an authenticated user to access sensitive environment variables on the server, potentially exposing secrets such as credentials or configuration data. This exposure can compromise confidentiality but does not affect integrity or availability. The impact is limited to users with authentication privileges, and the attack complexity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted individuals only and monitor for unusual access patterns related to environment variable exposure. Avoid deploying the affected versions in sensitive environments if possible.