Executive brief
Langflow OSS is a visual tool used to build and manage AI-powered agent workflows. A vulnerability exists where the software uses hard-coded administrative credentials that cannot be changed by the user, allowing an unauthorized person to gain full control over the system. This could lead to the theft of sensitive AI model data, exposure of connected database credentials, or complete takeover of the AI service.
Technical details
IBM Langflow OSS contains a use of hard-coded credentials (CWE-798) within its authentication and communication modules. Specifically, the application enforces default superuser credentials at startup, which remain active even if an operator attempts to override them using environment variables. An unauthenticated remote attacker can exploit this to gain superuser access to the Langflow interface and API. This access can be leveraged to execute arbitrary code, access private vector stores (Chroma/FAISS), or intercept outbound communications to external AI components. The vulnerability is resolved in version 1.10.2.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.1
Timeline
- 2026-07-14: disclosed: Initial publication of IBM security bulletin
- 2026-07-14: patched: Version 1.10.2 released to address the vulnerability
- 2026-07-17: advisory: NVD publication date