CVE-2026-97680 IBM CVE debrief

Who should care

Defenders and security teams responsible for IBM Langflow OSS deployments, particularly in environments with authenticated remote access, should assess potential exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-97680 is a high-severity vulnerability in IBM Langflow OSS that could allow remote authenticated attackers to obtain sensitive information or inject malicious data. Defenders should prioritize verifying exposure, assessing potential impacts, and updating access controls to prevent data leakage or injection attempts.

• Potential data leakage or exposure of sensitive information
• Possible injection of malicious data through the vertex result caching subsystem
• Need for verification of Langflow OSS version and deployment context
• Priority for updating access controls and monitoring for potential attacks

Technical summary

IBM Langflow OSS 1.0.0 through 1.12.2 is vulnerable to improper access control in the vertex result caching subsystem, allowing a remote authenticated attacker to obtain sensitive information or inject malicious data. The vulnerability has a high CVSS score of 8.3 and is considered a high-severity issue. Defenders should prioritize verifying exposure, assessing potential impacts, and updating access controls to prevent data leakage or injection attempts.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential data leakage or injection in Langflow OSS deployments, particularly in environments with authenticated remote access.

Recommended defensive actions

• Verify Langflow OSS version and check if it falls within the affected range (1.0.0 to 1.12.2)
• Assess the deployment context for potential exposure, particularly in environments with authenticated remote access
• Review and update access controls for the vertex result caching subsystem
• Monitor for potential data leakage or injection attempts

Evidence notes

The CVE record and source item provide details on the vulnerability in IBM Langflow OSS, including affected versions and a brief description of the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.