CVE-2026-10560 is an improper authentication vulnerability (CWE-287) affecting IBM Langflow OSS versions 1.0.0 through 1.9.6. The issue exists in the /api/v1/build_public_tmp/ endpoints, which do not enforce authentication, enabling unauthenticated attackers to access sensitive build event data or cancel jobs if they know a valid job identifier. This leads to confidentiality breaches and denial of service impacts. The CVSS 3.1 base score is 8.2, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact and no availability impact. No official patch or remediation guidance is currently available from IBM, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated remote attackers to disclose sensitive build event information and disrupt job processing by cancelling jobs. This compromises confidentiality and causes denial of service to legitimate users relying on job execution. Integrity impact is limited as attackers cannot modify data beyond cancelling jobs. Availability impact is not indicated beyond denial of service caused by job cancellation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints through network controls or authentication proxies where possible to prevent unauthenticated access. Monitor for unusual job cancellation activity. Follow IBM's advisories for updates on official fixes or mitigations.