CVE-2026-7874: Langflow

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.

Affected products

• Langflow Langflow: from 1.0.0, up to and including 1.10.0

Published 2026-06-30. Last modified 2026-07-02.