CVE Watch30 jul 2026

CVE-2026-13442

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and

CVSS

7.1

Alto

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 28 jul 2026 · Última mod.: 30 jul 2026 · CWE-520

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-292026-08-03

Descripción técnica

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

Referencias oficiales

www.ibm.comhttps://www.ibm.com/support/pages/node/7279988

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-134448.1 ALT

11.6%

——3IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.5d