What is the CVSS score of CVE-2026-10547?

CVE-2026-10547 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by CVE-2026-10547?

IBM Langflow OSS versions 1.0.0-1.10.3 contain a broken access control vulnerability that allows authenticated users to inject malicious data into the shared workflow cache, potentially corrupting or…. A patch is available.

How to fix or mitigate CVE-2026-10547?

Within 24 hours, identify all Langflow OSS instances running versions 1.0.0-1.10.3 and determine whether they operate in multi-user mode; if so, restrict network access to the POST /api/v1/build/{flow_id}/vertices endpoint via firewall rules or WAF policies as an interim control. Within 7 days, upgrade all affected Langflow instances to the vendor-patched version per IBM's advisory. Within 30 days, verify patch application across all production systems, review execution audit logs for evidence of cross-user cache corruption or anomalous flow invocations, and confirm the deprecated endpoint is no longer accessible.

IBM Langflow OSS CVE-2026-10547

EUVD-2026-53551 HIGH

Improper Access Control (CWE-284)

2026-08-05 ibm

GHSA-f7wm-r5v3-mxr4

Authentication Bypass Denial Of Service IBM Langflow Oss

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network API reachable with only a valid user session (PR:L); no confidentiality impact per description; integrity and availability both high from cache poisoning and DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 19:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Aug 06, 2026 - 19:37 NVD

MEDIUM HIGH

CVSS changed

Aug 06, 2026 - 19:37 NVD

5.9 (MEDIUM) 8.1 (HIGH)

Analysis Generated

Aug 05, 2026 - 18:49 vuln.today

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.

AnalysisAI

Broken access control in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to inject arbitrary graph data into the shared execution cache for flows they do not own, via the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. The endpoint performs no ownership validation, enabling cross-user cache pollution that can corrupt other users' workflow state, trigger unauthorized execution of foreign flows, or produce denial of service across a shared platform instance. No public exploit code exists and CISA KEV does not list this vulnerability; EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) collectively indicate low immediate exploitation risk despite the high CVSS score.

Technical ContextAI

IBM Langflow OSS is an open-source AI workflow orchestration platform (CPE: cpe:2.3:a:ibm:langflow_oss) that lets users build and execute directed graphs of AI components ('flows'). The deprecated build endpoint POST /api/v1/build/{flow_id}/vertices is responsible for populating vertex execution state into a shared server-side cache keyed by flow_id. The root cause is CWE-284 (Improper Access Control): the endpoint does not verify that the authenticated requester is the owner or has authorization over the target flow_id before writing to the shared cache. Because the cache is shared across users, a low-privileged attacker can arbitrarily overwrite or corrupt the cached execution graph of any flow on the platform by supplying an arbitrary flow_id in the URL path. The use of a deprecated endpoint suggests this code path was not actively maintained, increasing the likelihood that ownership guards were never retrofitted.

RemediationAI

Apply the vendor-released patch per IBM advisory https://www.ibm.com/support/pages/node/7282647; an exact fixed version is not independently confirmed from the available references, so consult the advisory directly for the target upgrade version. As a compensating control where immediate patching is not feasible, restrict access to the deprecated POST /api/v1/build/{flow_id}/vertices endpoint via reverse proxy or API gateway rules (e.g., block requests matching the path pattern /api/v1/build/*/vertices at the load balancer); note this may affect any integrations relying on the legacy build flow, which should be migrated to supported endpoints. Additionally, enforce strict multi-tenancy boundaries at the network or authentication layer to ensure untrusted users cannot reach the Langflow API directly, reducing the blast radius of any authenticated-user abuse.