CVE-2026-110200

MediumCVSS 6.5/10Last modified Nov 3, 2026

Description

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
IBM	Langflow OSS	>= 1.0.0, <= 1.12.4

References

https://www.ibm.com/support/pages/node/7293016Patch, Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1102028.8Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denie CVE-2026-1102038.8Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abus CVE-2026-1102048.8Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCom CVE-2026-1102058.8Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed ne CVE-2026-1102068.8Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitra CVE-2026-1102078.8Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, departme CVE-2026-1102087.1Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated u CVE-2026-1102096.5Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stor CVE-2026-110219.6Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compr CVE-2026-1102105.3Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission CVE-2026-1102118.1iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete othe CVE-2026-1102124.3Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outsi