Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
IBM Langflow OSS — Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H H 9.8 .0046 38.0 —
AFFECTED
Product Versions Fixed
Langflow OSS 1.0.0 – —
TIMELINE
Jun 26 Reserved by ibm
Jul 17 Published (CNA: ibm)
Jul 23 RESCORED — CVE-2026-13448 (IBM Langflow OSS). CVSS 8.1 → 9.8 (NVD).
Description
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 26, 2026 | Reserved | Reserved by ibm |
| July 17, 2026 | Published | Published (CNA: ibm) |
| July 23, 2026 | RESCORED | RESCORED — CVE-2026-13448 (IBM Langflow OSS). CVSS 8.1 → 9.8 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| IBM | Langflow OSS | — | 1.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-13448 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.