Skip to main content

IBM Langflow OSS EUVDEUVD-2026-53552

| CVE-2026-9130 HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-05 ibm GHSA-vph6-jp7f-x3cx
IBM Information Disclosure Langflow Oss Authentication Bypass
7.1
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
vuln.today AI
7.1 HIGH

Network-accessible API endpoints, PR:L for mandatory authentication, C:H for full cross-user chat history disclosure, I:L for message injection via store_message, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 05, 2026 - 18:47 vuln.today
CVE Published
Aug 05, 2026 - 18:16 cve.org
HIGH 7.1

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

AnalysisAI

Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to multi-user Langflow instance
Delivery
Enumerate or guess victim user session_id
Exploit
Craft API request to /api/v1/run/* or /api/v2/workflow/* with victim session_id
Execution
MemoryComponent returns victim chat history without ownership validation
Impact
Exfiltrate sensitive conversation data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following: (1) a multi-user Langflow OSS deployment with LANGFLOW_AUTO_LOGIN=False explicitly configured - single-user and default-mode deployments are fully excluded; (2) the attacker must hold a valid authenticated account on the target instance (CVSS PR:L confirmed); (3) the attacker must obtain or successfully guess a valid session_id belonging to another user, which may be predictable depending on session_id generation logic. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N scoring 7.1 is well-grounded: network reachability, low complexity, and High confidentiality impact accurately reflect the ease and consequence of exploitation for an authenticated attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user in a multi-user Langflow deployment enumerates or guesses a valid session_id belonging to a colleague, then issues a crafted GET request to /api/v1/responses or /api/v2/workflow/* with that session_id. The MemoryComponent returns the victim's full chat history without validating that the requesting user owns the session, exposing potentially sensitive AI workflow conversations including business logic, credentials, or confidential query content.
Remediation Apply the vendor-released patch per IBM advisory at https://www.ibm.com/support/pages/node/7282647. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Langflow deployments and confirm whether versions 1.0.0-1.10.3 are in use and configured for multi-user access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Langflow Oss

View all
CVE-2026-9198 CRITICAL POC
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
CVE-2026-10561 CRITICAL
10.0 Jun 22

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
CVE-2026-9135 CRITICAL
9.9 Jul 17

Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
CVE-2026-8476 CRITICAL
9.9 Jul 17

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
CVE-2026-8481 CRITICAL
9.9 Jul 17

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
CVE-2026-8859 CRITICAL
9.9 Jul 17

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
CVE-2026-12946 CRITICAL
9.9 Jul 30

Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
CVE-2026-13435 CRITICAL
9.9 Jul 30

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
CVE-2026-8635 CRITICAL
9.9 Jul 17

Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
CVE-2026-7873 CRITICAL
9.9 Jun 30

Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
CVE-2026-8505 CRITICAL
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication

CVE-2026-12940 CRITICAL POC
9.8 Jul 30

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-53552 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy