CVE-2026-13444

8.1 Élevée

Publiée le 30/07/2026 à 21:17 · Modifiée le 04/08/2026 à 22:14 · Analysée par le NVD · Source : psirt@us.ibm.com

Description

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

Traduire en français

Produits concernés

IBM Langflow OSS
Langflow langflow

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-520

Références

https://www.ibm.com/support/pages/node/7279989 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories