PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-103360 IBM CVE debrief

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. This vulnerability may lead to potential sensitive information disclosure in environments with remote authenticated access. Defenders should assess exposure and prioritize remediation, focusing on verifying and remediating this vulnerability, especially in environments with remote authenticated access, due to potential sensitive information disclosure. The CVE record and source item provide details on the vulnerability in IBM Langflow OSS. However, additional information on exploitation, impact, and is

Vendor
IBM
Product
Langflow OSS
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-06
Original CVE updated
2026-10-07
Advisory published
2026-10-06
Advisory updated
2026-10-07

Who should care

Defenders responsible for IBM Langflow OSS deployments, especially in environments with remote authenticated access, should assess exposure and prioritize remediation.

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in IBM Langflow OSS deployments, especially in environments with remote authenticated access, due to potential sensitive information disclosure.

  • Potential sensitive information disclosure
  • Remote authenticated access exploitation
  • Pathname restriction bypass vulnerability

Technical summary

IBM Langflow OSS 1.0.0 through 1.12.2 is vulnerable to sensitive information disclosure due to improper limitation of a pathname to a restricted directory. A remote authenticated attacker could exploit this vulnerability to obtain sensitive information.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in IBM Langflow OSS deployments, especially in environments with remote authenticated access.

Recommended defensive actions

  • Verify IBM Langflow OSS version and apply patches if necessary
  • Restrict access to sensitive directories
  • Monitor for potential sensitive information disclosure

Evidence notes

The CVE record and source item provide details on the vulnerability in IBM Langflow OSS. However, additional information on exploitation, impact, and remediation may be required for comprehensive risk assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-103360 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-103360

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-103360 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-103360

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Langflow OSS is affected by multiple vulnerabilities

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103360.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.ibm.com/support/pages/node/7290694

    Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.