SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-19297 2026-08-13

CVE-2026-19297: IBM Langflow OSS Authentication Brute-Force Flaw Rated Critical (CVSS 9.1)

"IBM disclosed a critical vulnerability in Langflow OSS 1.0.0 through 1.9.6 that, per the vendor advisory, could allow an unauthenticated remote attacker to gain unauthorized access to user accounts because the…"

IBM disclosed a critical vulnerability in Langflow OSS 1.0.0 through 1.9.6 that, per the vendor advisory, could allow an unauthenticated remote attacker to gain unauthorized access to user accounts because the application does not restrict excessive authentication attempts.

What Is It

CVE-2026-19297 is an improper restriction of excessive authentication attempts (CWE-307) in IBM Langflow OSS. Per IBM's advisory, the flaw "could allow a remote attacker to obtain unauthorized access to user accounts." The advisory does not detail the specific mechanism, but weaknesses of this class typically stem from missing rate limiting or lockout on the authentication path, which would let an attacker submit credential guesses repeatedly without being throttled.

The CVE was published on 2026-08-13 with a source identifier of [email protected] and currently carries an NVD status of "Received," meaning the record has not yet completed NVD analysis. Details may change as analysis proceeds.

Why It Matters

IBM assigned a CVSS 3.1 base score of 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Every exploitability metric is at its worst setting: network attack vector, low attack complexity, no privileges required, and no user interaction. That yields a maximum exploitability subscore of 3.9. Impact is scored high for both confidentiality and integrity (impact subscore 5.2), which in CVSS terms means an attacker who succeeds would be able to read and modify data belonging to the compromised account. Availability is unaffected. These are vendor-assigned metrics rather than an independent assessment of real-world exploitability.

There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.

What's Vulnerable

Patch Status

The supplied record does not specify a fixed version or state a required remediation deadline. The only vendor reference is IBM support node 7283558, which should be treated as the authoritative source for fix availability and upgrade guidance. Operators running Langflow OSS in the 1.0.0–1.9.6 range should consult that advisory directly and, in the interim, consider restricting network exposure of the authentication endpoint.

Sources