What is the CVSS score of CVE-2026-10700?

CVE-2026-10700 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-10700?

Yes, a patch is available for CVE-2026-10700. Update the affected software to the latest version immediately.

IBM Langflow OSS CVE-2026-10700

EUVD-2026-51247 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-30 ibm

GHSA-c6gg-2q9r-m9jw

Authentication Bypass Information Disclosure IBM Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

The unauthenticated image endpoint (the more severe of the two flaws) requires no credentials, network-accessible, low complexity, and yields high confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:56 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/{flow_id}/{file_name} endpoint does not enforce authentication or authorization checks, allowing unauthenticated remote attackers to retrieve image files associated with any flow by specifying a valid flow_id and file_name.Additionally, the /api/v1/files/download/{flow_id}/{file_name} endpoint requires authentication but fails to properly validate ownership of the requested resource. As a result, an authenticated user can access files belonging to other users by supplying arbitrary identifiers, leading to an authorization bypass (IDOR).Successful exploitation may result in unauthorized disclosure of sensitive data, including files stored in private flows. This issue breaks tenant isolation in multi-user deployments.

AnalysisAI

Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.

Technical ContextAI

IBM Langflow OSS is an open-source LLM workflow orchestration platform forked from the Langflow project, designed for building and deploying AI pipelines. The affected versions (1.0.0-1.8.4, per CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*) expose a file handling REST API at /api/v1/files/. The root cause class is CWE-639 (Authorization Through User-Controlled Key), a form of Insecure Direct Object Reference (IDOR): the API uses attacker-supplied identifiers (flow_id, file_name) as the sole access gate without verifying that the requesting principal owns or is permitted to access the referenced resource. The image endpoint compounds this by entirely omitting authentication middleware, reducing the attack to a simple HTTP GET with guessed or enumerated identifiers. In multi-tenant deployments, flow_id values may be discoverable through legitimate API use, error messages, or enumeration.

RemediationAI

Apply the vendor-released patch per IBM Security Advisory at https://www.ibm.com/support/pages/node/7279675. Until patching is complete, organizations should restrict network access to the /api/v1/files/ endpoints via API gateway rules, reverse proxy ACLs, or firewall policy, accepting the trade-off of breaking legitimate file retrieval functionality for external clients. For the unauthenticated image endpoint specifically, adding authentication enforcement at the reverse proxy layer (e.g., requiring a valid session cookie or bearer token before proxying requests to /api/v1/files/images/) provides a meaningful compensating control. For the IDOR download endpoint, there is no safe compensating control short of disabling the endpoint entirely, as the flaw is in server-side authorization logic. Multi-tenant operators should audit file access logs for anomalous cross-tenant flow_id access patterns as a detection measure.