Stored Cross-Site Scripting Vulnerability in IBM Langflow Desktop
CVE-2026-3346

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Langflow Desktop
Vendor
CVE Published:
30 April 2026

What is CVE-2026-3346?

IBM Langflow Desktop versions 1.6.0 to 1.8.4 are susceptible to a stored cross-site scripting vulnerability. This flaw enables an authenticated user to inject arbitrary JavaScript code into the Web UI. As a result, the normal functionality of the application can be altered, potentially leading to the disclosure of sensitive information such as user credentials during a trusted session. It is crucial for users of these versions to apply the necessary patches to mitigate this risk.

Affected Version(s)

Langflow Desktop 1.6.0 <= 1.8.4

References

https://www.ibm.com/support/pages/node/7271095
vendor-advisorypatch

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.