CVE-2026-10560 describes an improper authentication vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.6. The issue exists in the /api/v1/build_public_tmp/ endpoints, which do not enforce authentication checks. This allows unauthenticated attackers to access sensitive build event data and cancel jobs by supplying valid job identifiers. The vulnerability results in confidentiality loss and denial of service conditions. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. There is no vendor advisory or patch available at this time, and the product is not a cloud service, so remediation must be managed by the user.

An attacker without authentication can read sensitive build event data and cancel active jobs by exploiting the missing authentication on the specified API endpoints. This leads to information disclosure and denial of service against the affected IBM Langflow OSS instances. The confidentiality impact is high, integrity impact is low, and availability impact is none according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should consider restricting access to the vulnerable endpoints through network controls or other compensating controls until a patch is available.