CVE WatchJul 30, 2026

CVE-2026-13442

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and

CVSS

7.1

High

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jul 28, 2026 · Last modified: Jul 30, 2026 · CWE-520

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-292026-08-03

Technical description

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

Official references

www.ibm.comhttps://www.ibm.com/support/pages/node/7279988

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-134448.1 HIG

11.6%

——3IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.5d