https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 14:20:11 +0000 https://vulnerability.circl.lu/sighting/7050ff8e-7f67-4014-a5d0-46ff2bb95bb9/export {"uuid": "7050ff8e-7f67-4014-a5d0-46ff2bb95bb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105698", "type": "seen", "source": "https://gist.github.com/alon710/f2524db396d7ed518818052701b0f388", "content": "# CVE-2026-105698: CVE-2026-105698: Missing Authorization in Deprecated Chat Vertices Endpoints in Langflow\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105698\n\n## Summary\nA missing authorization vulnerability in Langflow versions 1.0.0 through 1.10.0 allows authenticated users (and unauthenticated users in versions prior to 1.7.2) to access private workflow structures and execute graph components by targeting deprecated API endpoints.\n\n## TL;DR\nUnauthenticated or low-privilege users can execute private flow vertices and read workflow configurations in Langflow versions prior to 1.10.1.\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00177\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Langflow\n- langflow-base\n- **langflow**: >= 1.0.0, < 1.10.1 (Fixed in: `1.10.1`)\n- **langflow-base**: < 0.10.1 (Fixed in: `0.10.1`)\n\n## Mitigation\n\n- Upgrade Langflow to version 1.10.1 or higher.\n- Upgrade langflow-base to version 0.10.1 or higher.\n- Implement reverse proxy rules to drop requests to deprecated vertices endpoints.\n- Configure WAF signatures to detect and block access to endpoints matching the deprecated route paths.\n\n**Remediation Steps:**\n1. Identify all deployment instances of Langflow and verify current running versions.\n2. Execute pip update command: pip install --upgrade langflow langflow-base\n3. Verify the application version reports 1.10.1 (Langflow) and 0.10.1 (langflow-base) or newer.\n4. Deploy custom Nginx ingress or WAF configurations if patching windows are delayed.\n\n## References\n\n- [GitHub Security Advisory GHSA-gh98-4phw-6fmw](https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw)\n- [Fix Commit](https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55)\n- [OSS Authorization PR #13153](https://github.com/langflow-ai/langflow/pull/13153)\n- [Official Release 1.10.1](https://github.com/langflow-ai/langflow/releases/tag/v1.10.1)\n- [National Vulnerability Database (NVD) Page](https://nvd.nist.gov/vuln/detail/CVE-2026-105698)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-105698)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105698) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T12:30:31.000000Z"} {"uuid": "7050ff8e-7f67-4014-a5d0-46ff2bb95bb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105698", "type": "seen", "source": "https://gist.github.com/alon710/f2524db396d7ed518818052701b0f388", "content": "# CVE-2026-105698: CVE-2026-105698: Missing Authorization in Deprecated Chat Vertices Endpoints in Langflow\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105698\n\n## Summary\nA missing authorization vulnerability in Langflow versions 1.0.0 through 1.10.0 allows authenticated users (and unauthenticated users in versions prior to 1.7.2) to access private workflow structures and execute graph components by targeting deprecated API endpoints.\n\n## TL;DR\nUnauthenticated or low-privilege users can execute private flow vertices and read workflow configurations in Langflow versions prior to 1.10.1.\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00177\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Langflow\n- langflow-base\n- **langflow**: >= 1.0.0, < 1.10.1 (Fixed in: `1.10.1`)\n- **langflow-base**: < 0.10.1 (Fixed in: `0.10.1`)\n\n## Mitigation\n\n- Upgrade Langflow to version 1.10.1 or higher.\n- Upgrade langflow-base to version 0.10.1 or higher.\n- Implement reverse proxy rules to drop requests to deprecated vertices endpoints.\n- Configure WAF signatures to detect and block access to endpoints matching the deprecated route paths.\n\n**Remediation Steps:**\n1. Identify all deployment instances of Langflow and verify current running versions.\n2. Execute pip update command: pip install --upgrade langflow langflow-base\n3. Verify the application version reports 1.10.1 (Langflow) and 0.10.1 (langflow-base) or newer.\n4. Deploy custom Nginx ingress or WAF configurations if patching windows are delayed.\n\n## References\n\n- [GitHub Security Advisory GHSA-gh98-4phw-6fmw](https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw)\n- [Fix Commit](https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55)\n- [OSS Authorization PR #13153](https://github.com/langflow-ai/langflow/pull/13153)\n- [Official Release 1.10.1](https://github.com/langflow-ai/langflow/releases/tag/v1.10.1)\n- [National Vulnerability Database (NVD) Page](https://nvd.nist.gov/vuln/detail/CVE-2026-105698)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-105698)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105698) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T12:30:31.000000Z"} https://vulnerability.circl.lu/sighting/7050ff8e-7f67-4014-a5d0-46ff2bb95bb9/export Thu, 08 Oct 2026 12:30:31 +0000 https://vulnerability.circl.lu/sighting/713ac6f0-c141-49e0-9318-9f1bed5c40e0/export {"uuid": "713ac6f0-c141-49e0-9318-9f1bed5c40e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105698", "type": "published-proof-of-concept", "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw", "content": "", "creation_timestamp": "2026-09-28T17:13:05.000000Z"} {"uuid": "713ac6f0-c141-49e0-9318-9f1bed5c40e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105698", "type": "published-proof-of-concept", "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw", "content": "", "creation_timestamp": "2026-09-28T17:13:05.000000Z"} https://vulnerability.circl.lu/sighting/713ac6f0-c141-49e0-9318-9f1bed5c40e0/export Mon, 28 Sep 2026 17:13:05 +0000