PatchSiren cyber security CVE debrief

CVE-2026-12945 IBM CVE debrief

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints. This vulnerability, classified as HIGH with a CVSS score of 7.1, affects deployments of IBM Langflow OSS within the specified version range. The vulnerability enables authenticated users to access and manipulate build jobs due to improper access control mechanisms. Evidence from the CVE record and NVD detail suggests verifying affected deployments, reviewing official advisories, and planning vendor-supported updates. Defenders should verify the scope of the vulnerability and review compensating controls for exposed systems. The vulnerability has been publicly disclosed, and IBM support pages provide further details on remediation steps.

Vendor: IBM
Product: Langflow OSS
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-30
Original CVE updated: 2026-07-31
Advisory published: 2026-07-30
Advisory updated: 2026-07-31

Who should care

Users of IBM Langflow OSS 1.0.0 through 1.10.1 should review and apply vendor remediation to prevent authenticated users from accessing and manipulating build jobs. Affected operators, platforms, and security teams should prioritize vulnerability management and review compensating controls for exposed systems. Security teams should also monitor for suspicious activity on build jobs and review relevant logs for exposed assets that need extra review.

Technical summary

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints. The vulnerability has a CVSS score of 7.1 and is classified as HIGH. Affected product deployments should be reviewed for exposure, and defenders should focus on restricting access to build job logs and endpoints, as well as monitoring for suspicious activity.

Defensive priority

Authenticated users may access and manipulate build jobs due to improper access control.

Recommended defensive actions

Review and apply vendor remediation for CVE-2026-12945
Restrict access to build job logs and endpoints
Monitor for suspicious activity on build jobs
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. IBM support page reference is provided for further details. The vulnerability affects IBM Langflow OSS 1.0.0 through 1.10.1, allowing authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints. Evidence limits suggest verifying affected deployments, reviewing official advisories, and planning vendor-supported updates. Defenders should verify the scope of the vulnerability and review compensating controls for exposed systems.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T17:16:28.173Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.