Threats Tagged 'cve-2026-18904'

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an authorization bypass vulnerability due to a namespace collision between user identifiers. This flaw could allow a remote attacker to obtain sensitive information and inject unauthorized messages without authentication.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an authorization bypass vulnerability due to a namespace collision between user identifiers. This flaw could allow a remote attacker to access sensitive information and inject unauthorized messages. The vulnerability is identified as CWE-639 and has a high severity with a CVSS score of 8.2.

Multiple vulnerabilities have been identified in Langflow OSS, an open-source visual interface for creating LLM-based applications. The issues relate to authentication weaknesses (CWE-287). The affected versions include all Langflow OSS versions prior to 1.11.2. No official patch or remediation has been confirmed yet. The severity of these vulnerabilities is assessed as high based on available data. There are no known exploits in the wild at this time. The vendor has not provided specific remediation guidance or patches. Users should monitor vendor advisories for updates and apply fixes once available.