IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow… (CVE-2026-17627)

CVE-2026-17627 affects IBM Langflow OSS versions 1.0.0 through 1.10.2. The vulnerability arises from improper authorization, enabling a remote attacker with authentication to access sensitive information and inject messages into the workflow history. This could lead to unauthorized disclosure and modification of workflow data. The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, low confidentiality and integrity impact, and no availability impact.

An attacker with valid authentication credentials can exploit this vulnerability to access sensitive information and alter workflow history by injecting messages. This compromises data confidentiality and integrity within the affected versions of IBM Langflow OSS. There is no reported impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and review authorization policies to limit exposure. Monitor for updates from IBM regarding patches or official mitigations.