| Component | Langflow |
| Severity | high (CVSS 8.3) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
| Published (NVD) | 2026-10-20 |
| Last modified | 2026-10-21 |
| Affected versions | >= 1.0.0, <= 1.12.4 from the CVE Program record written by the CNA that assigned the CVE |
| Fixed in | see the vendor advisory |
| Weakness | CWE-639 |
| CISA KEV | not listed |
NVD description
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
What to do
- No fixed release is known yet: follow the vendor advisory below and keep Langflow off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.