What is the CVSS score of CVE-2026-9130?

CVE-2026-9130 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by CVE-2026-9130?

IBM Langflow OSS versions 1.0.0-1.10.3 expose organizations to a data breach risk where any authenticated user can access other users' private conversation histories.. A patch is available.

How to fix or mitigate CVE-2026-9130?

Within 24 hours, identify all Langflow deployments and confirm whether versions 1.0.0-1.10.3 are in use and configured for multi-user access. Patch available per vendor advisory-within 7 days, apply the vendor-released patch to upgrade all affected instances to the patched version. Within 30 days, audit access logs to confirm whether the vulnerability was exploited, implement mandatory access controls restricting users to their own conversation history, and establish monitoring for cross-user data access anomalies.

IBM Langflow OSS CVE-2026-9130

EUVD-2026-53552 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-05 ibm

GHSA-vph6-jp7f-x3cx

Authentication Bypass Information Disclosure IBM Langflow Oss

7.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-accessible API endpoints, PR:L for mandatory authentication, C:H for full cross-user chat history disclosure, I:L for message injection via store_message, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:47 vuln.today

CVE Published

Aug 05, 2026 - 18:16 cve.org

HIGH 7.1

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

AnalysisAI

Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. No public exploit has been identified at time of analysis, but the straightforward exploitation path and High confidentiality impact make this a genuine remediation priority for any multi-user Langflow deployment.

Technical ContextAI

IBM Langflow OSS is an open-source AI application workflow builder derived from the Langflow project. The vulnerability resides in the MemoryComponent, which manages persistent chat history storage and retrieval across workflow sessions. The retrieve_messages and store_message methods use session_id as the sole record-filtering key, without cross-validating against the authenticated user's flow_id or user_id ownership - a classic Insecure Direct Object Reference (IDOR) pattern mapping to CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-284 (Improper Access Control), though no formal CWE was assigned in the advisory. Three distinct API surface areas are affected: /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. The CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* confirms all versions from 1.0.0 through 1.10.3 are within scope.

RemediationAI

Apply the vendor-released patch per IBM advisory at https://www.ibm.com/support/pages/node/7282647. An exact fixed version number was not specified in the provided data and must be confirmed directly from the IBM advisory before upgrading. As an immediate compensating control for deployments that cannot patch promptly, restrict network access to the affected endpoints (/api/v1/run/*, /api/v1/responses, /api/v2/workflow/*) to a trusted, audited user set via a WAF or reverse proxy allowlist - this limits the attacker pool without eliminating multi-user functionality. Setting LANGFLOW_AUTO_LOGIN=True eliminates the vulnerability entirely but removes multi-user isolation and is unsuitable for shared production environments. Monitor application logs for anomalous cross-user session_id access patterns as a detection measure.