What is CVE-2026-81268?

CVE-2026-81268 is a high-severity vulnerability in IBM Langflow Oss, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2026-09-10.

How severe is CVE-2026-81268?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in IBM Langflow Oss

CVE-2026-81268

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Ibm Langflow Oss

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-81268?: CVE-2026-81268 is a high-severity vulnerability in IBM Langflow Oss, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2026-09-10.
How severe is CVE-2026-81268?: High severity. CVSS v3 base score is 8.1 out of 10.