VulnSocial

CVE-2026-13444Disclosure(langflow / langflow)

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

langflow CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-520

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • langflow

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
langflow
Products
langflow

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-30: 2Technical Details · 2026-07-30: 207-30
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-13444 IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_… https://www.cve.org/CVERecord?id=CVE-2026-13444 ----- Traducción: CVE-2026-13444 IBM… http://infoflow.cloud`

    Post summary

    This post briefs the CVE‑2026‑13444 vulnerability in IBM Langflow OSS, describing how attackers can hijack private vector documents through a malicious flow; no PoC, exploit, or patch is referenced.

    0000043
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-13444 IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_… https://www.cve.org/CVERecord?id=CVE-2026-13444

    Post summary

    The post announces a newly disclosed vulnerability in IBM Langflow OSS that permits attackers to read private vector documents via crafted flows, with no indication of exploitation, patches, or PoC.

    00000644
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applangflowlangflow---

Explore more

Back to dashboardlangflow CVEslangflow vulnerabilities