CVE Watch30 jul 2026

CVE-2026-13444

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow wit

CVSS

8.1

Alto

EPSS

0.2%

p12

KEV

—

Exploit Today

0-100

Publicado: 30 jul 2026 · Última mod.: 30 jul 2026 · CWE-520

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-312026-08-03

Descripción técnica

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

Referencias oficiales

www.ibm.comhttps://www.ibm.com/support/pages/node/7279989

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-134427.1 ALT

7.1%

——2IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.5d