CVE-2026-13442 is a misconfiguration vulnerability (CWE-520) in IBM Langflow OSS versions 1.0.0 through 1.10.1. The vulnerability arises from improper use of impersonation, enabling an attacker with limited privileges to reuse another user's FAISS namespace. This unauthorized reuse allows access to vector content intended only for the owner and permits the attacker to influence later query results by poisoning them persistently. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact with limited integrity impact.

An attacker with limited privileges can access vector content belonging to other users, causing cross-user information disclosure. Additionally, the attacker can persistently poison query results, affecting the integrity of the data returned to users. There is no impact on system availability. This could lead to unauthorized data exposure and manipulation of query outputs within the affected IBM Langflow OSS environment.

No official patch or remediation has been confirmed or published by IBM at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access privileges to trusted users only and monitor for suspicious activity related to FAISS namespace usage. Avoid sharing credentials or namespaces across users to minimize risk.