Security advisories

This page lists security advisories for LumenFlow. Each advisory gives the affected versions, the fixed version, the severity, a one-sentence impact and the upgrade action. Technical mechanics are withheld until most installations have upgraded.

To report a vulnerability, email security@lumenflow.dev. Do not file in any public tracker. The reporting policy and response times are on the security policy page, and the machine-readable contact is at /.well-known/security.txt.

LF-2026-001: release notes in seven versions described fixed issues in too much detail

• Published: 27 Oct 2026
• Severity: Low
• Affected versions: 1.0.104 through 1.0.110
• Fixed in: 1.0.111
• Impact: the release notes shipped with the affected versions described already-fixed security hardening changes in more technical detail than intended. The notes do not make any running installation vulnerable, but they could help someone prepare an attack against an installation that has not applied the fixes.
• Action: upgrade to 1.0.111. No configuration change is needed.
• Already downloaded copies: copies of the affected versions that were already downloaded cannot be recalled. Treat their release notes as known to licensees.
• Credit: found by the LumenFlow team in an internal documentation review.