CVE-2026-110245
HIGH
CVSS 7.5
PoC Available
Published: 2026-10-29
Modified: 2026-10-30
Enriched via mock
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-110245 is a high-severity vulnerability with a CVSS score of 7.5 affecting langflow. Authentication can be bypassed allowing unauthenticated access. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.
Attack Chain
1
Reconnaissance
Attacker identifies authentication endpoint and tests for bypass conditions
2
Initial Access
Attacker exploits CVE-2026-110245 authentication flaw to gain unauthorized access without valid credentials
3
Discovery
Attacker enumerates accessible resources, users, and configurations
4
Collection
Attacker exfiltrates sensitive data accessible without proper authorization
MITRE ATT&CK Techniques
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against langflow endpoint — monitor access logs for anomalous params |
Remediation
1. Apply vendor-supplied security patches immediately.
2. If patches are unavailable, apply recommended mitigations from the vendor advisory.
3. Enable WAF rules or IDS signatures to detect exploitation attempts.
4. Monitor logs for indicators of compromise listed above.
5. Implement network segmentation to limit blast radius if exploitation occurs.
6. Subscribe to vendor security advisories for this product.
Quick Facts
| CVE ID | CVE-2026-110245 |
| CVSS Score | 7.5 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published | 2026-10-29 |
| Exploited | No |
| CISA KEV | No |
| PoC | Available |
Affected Products
-
langflow / langflow