Langflow Unauth Access via Auto-Login Endpoint (CVE-2026-9103) Advisory

Vulnerability Overview CVE ID: CVE-2026-9103 Description: Langflow allows remote attackers to gain unauthorized access via the endpoint. When the configuration is enabled (which is the default), this endpoint issues long-lived superuser tokens without requiring authentication. This can result in unauthorized network attackers obtaining full administrative access. Additionally, overly permissive Cross-Origin Resource Sharing (CORS) settings may expose tokens to unintended origins, increasing the risk of unauthorized access. CWE: CWE-306: Missing Authentication for Critical Function CVSS Source: IBM CVSS Base Score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Products Affected Product: Langflow OSS Affected Versions: 1.0.0-1.0.10 Remediation Fix Recommendation: IBM strongly recommends immediately resolving this vulnerability by upgrading Langflow OSS to version 1.0.10.1. Additional Information Document ID: 7278926 Date of Revision: July 2, 2026 Initial Release Date: July 2, 2026 Operating Systems: Windows, Linux, Mac OS References Complete CVSS v3 Guide On-line Calculator v3 Related Information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Credits Bugbunny (bugbunny-research) Bugbunny @bugbunny_ai bugbunny.ai https://x.com/bugbunny_ai Change History July 2, 2026: Initial release Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey the severity of vulnerabilities and assist in determining the urgency and priority of response. IBM provides the CVSS score "as is" and makes no express or implied warranties. Customers are responsible for assessing the impact of any actual or potential security vulnerability. IBM regularly updates records for components included in its products. If IBM identifies packages in the Product/Service inventory that were previously unrecognized, it will address the associated vulnerabilities regardless of the CVE date. The use of IBM products since that date does not indicate that IBM was aware of the vulnerability at the time the vulnerability date was established. We are working to make customers aware of relevant vulnerabilities as we become aware of them. The IBM security bulletins cited in the "Affected Products and Versions" section are intended to support only IBM-supported and non-extended-life products and versions. Therefore, citing unsupported or extended-life products and versions in this security bulletin does not constitute IBM's determination that they are unaffected by the vulnerability. Citing one or more unsupported versions in this security bulletin does not create an obligation for IBM to provide fixes for any unsupported or extended-life product or version.

Goal Reached Thanks to every supporter — we hit 100%!

Langflow Unauth Access via Auto-Login Endpoint (CVE-2026-9103) Advisory

More from this source