CVE-2026-19297 affects IBM Langflow OSS versions 1.0.0 through 1.9.6 and involves improper restriction of excessive authentication attempts (CWE-307). This vulnerability allows remote attackers to bypass authentication controls and gain unauthorized access to user accounts without requiring user interaction. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vendor has not yet provided an official fix or remediation level, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could lead to unauthorized access to user accounts, compromising confidentiality and integrity of user data. There is no impact on availability reported. The critical CVSS score reflects the potential severity of unauthorized access without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing compensating controls such as monitoring for unusual authentication attempts and enforcing rate limiting if possible. Avoid relying solely on the affected versions for sensitive deployments.