01 Record

CVE-2026-19297

Insufficient Authentication Brute Force Protection on Login Endpoint

CriticalPUBLISHEDCNA: ibm

Base score9.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

02 Description

Insufficient Authentication Brute Force Protection on Login Endpoint

Published: 2026-08-13 20:46Z21 HR AGO
Last updated: 2026-08-14 16:19Z2 HR AGO
Reserved: 2026-08-07
Assigning CNA: ibm
Record state: PUBLISHED
Severity: Critical (CVSS 9.1)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses: CWE-307
SSVC decision: ExploitationnoneAutomatableyesTechnical Impacttotal
Data version: 5.2
Document digest: 485cc467d8412b52b28473007ad9dd04427544e7ba5acd7bf63f3403f2763b15

VendorProductVersionsPlatforms

IBMLangflow OSS1.0.0 to 1.9.6—

IBM recommends addressing the vulnerability now by upgrading to Langflow OSS 1.10.0 or newer https://pypi.org/project/langflow/