Description

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-04T17:16:55.380Z",
  "pubdate": "2026-09-04T17:16:55.380Z",
  "executiveSummary": "A critical security vulnerability has been identified in IBM Langflow OSS versions 1.0.0 through 1.10.2, stemming from improper authorization controls within the platform.\nThis flaw enables a remote, authenticated attacker to bypass intended access restrictions to retrieve sensitive information and perform unauthorized message injection into workflow history logs.\nThe vulnerability represents a significant risk to data integrity and confidentiality within the workflow orchestration environment.\nThe attack is contingent upon the actor possessing a valid authenticated session, although they do not require administrative privileges to execute the exploit.\nSuccessful exploitation allows for the manipulation of audit trails and potential exposure of proprietary workflow data, which may be leveraged for further adversarial activities or reconnaissance.\nOrganizations relying on affected versions of IBM Langflow are exposed to potential insider threats or compromised user account scenarios where attackers can manipulate historical records to obfuscate malicious actions or exfiltrate sensitive process metadata.",
  "technicalDetails": "The vulnerability originates from a failure in the application's authorization framework, where the backend fails to strictly enforce object-level access controls for workflow history and sensitive data endpoints.\nIn IBM Langflow OSS versions 1.0.0 through 1.10.2, the API endpoints governing workflow history and process-related data do not adequately validate the identity of the requester against the ownership or permissions associated with the requested workflow resources.\nThe attack flow begins when an authenticated user sends crafted HTTP requests to the vulnerable API endpoints. Because the server-side logic lacks the necessary authorization checks, it processes these requests regardless of the user's lack of explicit authorization to access the specific workflow resource.\nAn attacker can exploit this by manipulating query parameters or request bodies to access workflows they do not own or have not been granted access to. By interacting with these unshielded endpoints, the attacker can retrieve sensitive process outputs, environment variables, or other metadata stored within the workflow context.\nFurthermore, the lack of strict input validation combined with the authorization flaw allows the attacker to inject arbitrary messages into the workflow history logs. This is achieved by interacting with the relevant persistence functions, where the application fails to verify the write-permissions of the authenticated user before committing the payload to the underlying database.\nThe vulnerable components are primarily located within the API routing and permission verification layers of the Langflow platform, which handle backend requests to the workflow management service.\nThe impact of this vulnerability is twofold: first, it results in a breach of data confidentiality by exposing potentially sensitive workflow execution data; second, it undermines the non-repudiation and integrity of the system by allowing the modification of workflow history.\nPost-exploitation, an attacker could maintain persistence by injecting deceptive logs to mislead administrative monitoring, exfiltrate sensitive credentials handled within workflows, or modify historical workflow states to bypass compliance audits.\nThe vulnerability does not require complex bypass techniques; standard HTTP client tools are sufficient to probe and manipulate the insecure endpoints once a valid session token is obtained."
}