IBM Langflow OSS CVE-2026-9225

Requires a valid authenticated low-privilege account on the IBM Langflow OSS instance (PR:L confirmed by CVSS vector). The attacker must know or be able to enumerate another user's storage namespace identifier (user ID or flow ID). The File/Read File component must be available for use in flows, and the /api/v1/run/advanced/{flow_id} endpoint must be reachable. Exploitation is limited to reading files already uploaded by other users - no write or delete capability. Single-user or isolated deployments are not practically affected. Default multi-tenant deployments where multiple untrusted users coexist are the primary risk scenario.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a score of 6.5, which is well-calibrated for this vulnerability. Network-reachable, low-complexity exploitation with only low-privilege authentication is required, and the confidentiality impact is high - cross-user file content is fully disclosed. There is no integrity or availability impact, and no scope change. No EPSS score or SSVC data was provided in the intelligence package, and the vulnerability is not listed in CISA KEV. No POC has been identified. The real-world risk is meaningful in multi-tenant Langflow deployments where users upload sensitive data (credentials, datasets, configuration files); in single-user or tightly controlled enterprise deployments, the practical impact is lower. The tag 'Authentication Bypass' in the input metadata is a mislabel - this is an authorization/IDOR issue, not an authentication bypass; authentication functions correctly.

An attacker with a valid low-privilege Langflow account constructs a flow execution request to /api/v1/run/advanced/{flow_id} with a crafted File/Read File component input referencing another user's storage namespace identifier. The backend reads and returns the target file's contents without validating ownership, disclosing potentially sensitive uploads such as API keys, datasets, or configuration files. No public exploit code has been identified at time of analysis, but the technique is straightforward for any user familiar with the platform's API.