Langflow CVE-2026-105698

The attacker must know the victim's flow UUID (an unguessable identifier obtained out-of-band, through disclosure, or enumeration) and the target must be running a version in the 1.0.0-1.10.0 range with the deprecated POST /api/v1/build/{flow_id}/vertices and /vertices/{vertex_id} handlers still reachable. On versions through 1.7.1, NO authentication is required; from 1.7.2 through 1.10.0, the caller needs only a valid authenticated account with no elevated privileges. Exploitation is most meaningful on shared/multi-user instances. Limiting factors capping impact: the flaw does NOT expose the victim's variable-store credentials and does NOT allow modification of the stored flow (read, enumerate, and execute only), and it is remediated in 1.10.1 / langflow-base 0.10.1.

This is a broken object-level authorization flaw (CWE-639, an IDOR) in Langflow's deprecated build-vertices endpoints, where build_graph_from_db_no_cache performed a primary-key lookup with no owner filter. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4 Medium) reflects network reachability, low attack complexity, and no user interaction, but assumes PR:L (an authenticated low-privilege account). Critically, the description reveals a version-dependent privilege requirement the single CVSS vector obscures: through 1.7.1 the handlers were reachable completely UNAUTHENTICATED (effectively PR:N, raising real risk toward ~6.5), while 1.7.2 through 1.10.0 require any authenticated-but-unprivileged account (PR:L). No EPSS score, KEV listing, or public POC is present in the input, so there is no evidence of active or at-scale exploitation; this signals a real but not urgent priority. The primary limiters are that the attacker must already know a victim's flow UUID (an unguessable value absent enumeration or disclosure) and that impact is read/execute only - the input explicitly states the flaw did NOT expose variable-store credentials and did NOT permit modification of the stored flow, which correctly caps confidentiality and integrity at Low. Net: a legitimate medium-severity authorization gap worth patching promptly in multi-tenant/shared Langflow deployments, but not a high-urgency, widely-weaponized emergency.

In a shared or multi-tenant Langflow instance, a low-privileged authenticated user (or, on versions through 1.7.1, an unauthenticated network caller) who has learned another user's flow UUID sends a POST to the deprecated /api/v1/build/{flow_id}/vertices endpoint. retrieve_vertices_order loads and caches the victim's private graph, the attacker enumerates vertex IDs, then invokes build_vertex to execute chosen vertices and read their outputs, disclosing private flow structure, configured values, and results while also triggering victim-configured side effects and build-history records. No public exploit was identified at the time of analysis, so exploitation requires custom tooling against these specific handlers.