IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive… (CVE-2026-19300)

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a vulnerability (CVE-2026-19300) where incomplete scrubbing of sensitive credential fields may allow a remote attacker to obtain sensitive information. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and has a CVSS 3.1 base score of 7.5, indicating high severity. The attack vector is network-based with no privileges or user interaction required. There is no indication of integrity or availability impact. No patch or official remediation guidance is currently provided in the input data.

A remote attacker can obtain sensitive information due to incomplete scrubbing of credential fields in the affected versions of IBM Langflow OSS. This exposure could lead to confidentiality breaches. There is no reported impact on integrity or availability. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected service and monitor for any unusual data exposure. Avoid exposing sensitive credential fields unnecessarily. Follow vendor updates for patches or official mitigations.