EUVD-2026-51272
GHSA-vrqm-44rp-59j5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Authenticated low-priv network access (PR:L) with low complexity yields high confidentiality (reading private docs) and high integrity (collection pollution); no availability impact and scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.
AnalysisAI
Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege account on the Langflow instance (PR:L) and that the target flow uses the Chroma vector store; the attacker must create a flow whose persist_directory and collection_name exactly match the victim's, meaning those values must be known, guessable, or left at defaults. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a network-reachable, low-complexity attack requiring only low-privilege authenticated access, with high confidentiality and integrity impact and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privilege user on a shared Langflow instance learns or guesses the persist_directory and collection_name used by a victim's private RAG flow, then builds their own flow with identical values and runs it, receiving the victim's exact private documents in the output. The same attacker can insert crafted documents into that shared collection to poison the victim's retrieval results. … |
| Remediation | Patch available per vendor advisory: upgrade IBM Langflow OSS to the fixed release described in IBM's advisory at https://www.ibm.com/support/pages/node/7279989 (no exact fixed version number is stated in the provided data, so confirm the target version directly from that advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Locate all IBM Langflow OSS deployments running versions 1.0.0-1.10.1 in your infrastructure and classify by data sensitivity and user count. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today