CVE-2026-13442
Langflow 1.0.0 – 1.10.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NSummary
CVE-2026-13442 is a high-severity .NET Misconfiguration: Use of Impersonation (CWE-520) vulnerability in Langflow Langflow. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-50066
Vulnerability Data
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned…
more
results.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops impersonation from granting unauthorized escalated privileges to OS resources.
Least privilege structurally prevents .NET impersonation from allowing execution at higher-than-intended privilege levels.
Secure configuration settings stop the dangerous impersonation misconfiguration from being introduced in the first place.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration management can enforce secure impersonation settings, but eliminating the weakness does not materially advance broader configuration governance.
Restricting privileged access rights directly limits the ability to grant impersonation privileges that escalate .NET process rights.
Secure SDLC practices can catch impersonation misconfigurations early, but removing the weakness does not fulfill the full lifecycle control objective.
Enforcing information-access restrictions prevents .NET code from obtaining the elevated file/OS rights that impersonation would otherwise allow.
Controls on privileged utility programs reduce the attack surface for impersonation misuse, yet fixing the weakness itself does not satisfy the control's wider intent.
Secure-coding standards discourage unsafe impersonation calls, yet eliminating this single weakness contributes little to the overall secure-coding program.