IBM Langflow OSS Vulnerability: Critical CVE Under Investigation
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- ibm langflow (npm)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.6. This vulnerability could allow unauthorized access to user accounts.
What happened
An early warning has been issued for a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.6. This vulnerability, tracked as CVE-2026-19297, could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts. The vulnerability was first flagged on 2026-08-13T21:17:45.870000+00:00. It is currently under investigation and has not been exploited in the wild.
To assess your exposure, check if your systems are using any of the affected versions of IBM Langflow OSS. If so, it is recommended to upgrade to a version beyond 1.9.6 and review your authentication mechanisms for potential unauthorized access.
What to do about it
- Upgrade to a version of IBM Langflow OSS beyond 1.9.6.
- Review your authentication mechanisms for potential unauthorized access.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
ibm langflow is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using IBM Langflow OSS versions 1.0.0 through 1.9.6.
What should I do right now?
Upgrade to a version of IBM Langflow OSS beyond 1.9.6 and review your authentication mechanisms for potential unauthorized access.
Has this vulnerability been exploited in the wild?
No, this vulnerability has not been exploited in the wild.