CVE-2026-17628

A Langflow session can reset its own account password without the existing password

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

Anyone holding an authenticated session can replace the account password without proving knowledge of the current password.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed IBM bulletin and CNA record do not document malicious exploitation or an affected customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The password-change handler accepts a current-password field but does not verify it against the stored credential.

Conditions required

An authenticated session for the account whose password will be changed. The endpoint restricts changes to the caller’s own account.

Potential impact

A stolen session could be converted into persistent password access or lock the owner out. Changing an unrelated user’s password is outside the documented behavior.

Affected versions and configurations

1.0.0 through 1.10.2, inclusive, according to IBM.

Fix and mitigation status

1.10.3 addresses this issue according to IBM.

Practical next steps

Upgrade to a supported release containing the 1.10.3 fix. Check for unexpected password changes after investigating a stolen session.

Operating lesson

Require fresh proof of identity for account recovery and credential changes.

Evidence and limits

The July 13 maintainer patch restores verification of the current password. It explicitly leaves minimum password complexity to a separate policy. IBM’s bulletin followed September 8 and its CNA September 14.

Sources