Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's `tool_code` so normal `/api/v1/build/...` calls by any user re-execute attacker code at each build.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-30 | 1 | Disclosure1 |
| 2026-07-01 | 1 | Patch1 |
| 2026-07-04 | 1 | Patch1 |
| 2026-07-09 | 2 | Disclosure1General1 |
Multiple Langflow OSS vulnerabilities, including the critical CVE-2026-10134 flaw, expose servers to code execution. Patch immediately. #Langflow #Vulnerabilities #CyberSecurity #CVE202610134 #InfoSec http://securityonline.info/langflow-oss-vulnerabilities/
Post summary
The text alerts to a critical CVE-2026-10134 in Langflow OSS that allows code execution and urges immediate patching.
🚨 CVE-2026-10134 — CVSS 10/10 ██████████ IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/eSyrNTpqpf
Post summary
IBM Langflow OSS versions 1.0.0 through 1.9.3 are vulnerable (CVE‑2026‑10134) to secret leakage; a patch has been released to address the critical flaw.
🔐 セキュリティトレンド (12:43 JST) ① 開発環境への不正アクセスでランサムメッセージ残置-Dockerと自宅ルーターの二重の設定不備が原因 https://rocket-boys.co.jp/security-measures-lab/docker-localhost-binding-security-guide/ ② IBMが発見-未認証RCEからAPIキーの越境流用まで広範囲に影響(CVE-2026-10134 https://rocket-boys.co.jp/security-measures-lab/langflow-unauthenticated-rce-cve-2026-10134/ ③ 「Codex」と「Claude」と4700行のコードで大規模スパム攻撃を止めた体験記 - (page 2) https://japan.zdnet.com/article/35249933/2/ ④ IBMとRed Hat、「Project Lightwell」を始動--AI悪用の攻撃から防御 - ZDNET Japan https://japan.zdnet.com/article/35250368/ ⑤ イラン「攻撃受けたら2倍の反撃」米を牽制“ホルムズ海峡完全封鎖”も 国営メディア - テレ朝NEWS https://news.tv-asahi.co.jp/news_international/articles/000517865.html #セキュリティ #CyberSecurity
Post summary
The tweet lists several security topics, including CVE‑2026‑10134 described as an unauthenticated RCE affecting API keys, but provides only technical details without evidence of active exploitation, PoC, or patches.
Langflowに重大な脆弱性6件、IBMが発見-未認証RCEからAPIキーの越境流用まで広範囲に影響(CVE-2026-10134、CVE-2026-7803、CVE-2026-7871、CVE-2026-7873、CVE-2026-10140、CVE-2026-7663) https://rocket-boys.co.jp/security-measures-lab/langflow-unauthenticated-rce-cve-2026-10134/ #セキュリティ対策Lab #security #securitynews
Post summary
IBM discovered six critical vulnerabilities in Langflow, including unauthenticated RCE and API key hijacking, as reported in the linked article.
🚨Critical - IBM Langflow OSS Code Injection with Full Compromise & Persistence (CVE-2026-10134) IBM Langflow OSS 1.0.0 through 1.9.3 contains a code injection flaw that gives an attacker sweeping control: read every secret available to the Langflow process; read and modify every flow, conversation, message, file upload, and saved component in the database; reach internal services; abuse cloud metadata endpoints; and laterally move to other tenants on the same instance. The attacker can also establish persistence by modifying the public flow's tool_code, so ordinary /api/v1/build/... calls by any user re-execute the attacker's code on every build. The flaw is remotely exploitable with no privileges and no user interaction - a maximum-severity CVSS 10.0. 👉Affected: IBM Langflow OSS 1.0.0–1.9.3; apply IBM's fix (see IBM advisory).
Post summary
The post announces a high-severity code injection vulnerability in IBM Langflow OSS (CVE-2026-10134), detailing its impact and urging users to apply the vendor patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |