Description
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.
Published: 2026-08-19
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.1 https://pypi.org/project/langflow/

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Description IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.
Title Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
First Time appeared Ibm
Ibm langflow
Weaknesses CWE-306
CPEs cpe:2.3:a:ibm:langflow:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow:1.10.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Ibm Langflow
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-19T17:38:06.110Z

Reserved: 2026-08-14T14:08:13.288Z

Link: CVE-2026-19875

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T18:16:36.557

Modified: 2026-08-19T18:16:36.557

Link: CVE-2026-19875

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function