Description

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-28T22:16:47.227Z",
  "pubdate": "2026-08-28T22:16:47.227Z",
  "executiveSummary": "A critical security vulnerability identified in IBM Langflow OSS versions 1.0.0 through 1.11.1 stems from a namespace collision between user identifiers. This flaw allows remote, unauthenticated attackers to bypass identity separation boundaries, leading to unauthorized information disclosure and the ability to inject malicious messages into user-specific contexts.\nThe vulnerability represents a significant risk to data integrity and confidentiality within the platform. By exploiting the collision, an attacker can masquerade as other users or access sensitive data associated with their identifiers. The impact includes the unauthorized manipulation of workflow data and the potential for exfiltrating confidential information stored or processed within the affected IBM Langflow instances. Exploitation does not necessarily require advanced administrative access, leveraging the logic error inherent in how the system resolves user namespaces. Organizations relying on affected versions are exposed to session hijacking or data poisoning scenarios that undermine the trust model of the application environment.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of user identifier mapping and namespace isolation logic within IBM Langflow OSS. In versions 1.0.0 through 1.11.1, the application fails to enforce strict segregation between distinct user entities when handling requests that rely on identifier lookups. This namespace collision occurs when the backend resolution engine interprets identical or overlapping identifiers across different contexts, effectively merging or aliasing user scopes.\nTechnically, when the system receives an input identifier for user authentication or data retrieval, the internal routing logic performs a lookup against a shared namespace that lacks sufficient prefixing or tenant-specific qualifiers. Because the application logic does not validate the uniqueness or the origin scope of these identifiers against the current session context, an attacker can craft specifically formatted requests that trigger a collision. By supplying an identifier known to conflict with another user, the attacker redirects the application's internal state to point to the resource or message queue of the victim.\nThe attack flow follows a predictable pattern: first, the attacker observes or predicts the identifier structure used by the application for user identification. Second, the attacker submits a request—such as a data query or message injection command—using an identifier that correlates with the target namespace. Because the system performs an insecure lookup, the request is processed within the context of the target user rather than the attacker's own scope.\nPost-exploitation, the attacker gains the ability to read sensitive information intended for the victim. Furthermore, the vulnerability allows for the injection of unauthorized messages into the victim's workspace. Since the application fails to verify the requestor's authorization over the resolved namespace, the system accepts the injected data as legitimate input from the masqueraded identity. This persistent flaw results in a breakdown of multi-tenancy or user-isolation constraints, providing an attacker with an avenue to influence application state or extract private user data without requiring prior authentication or specific elevated privileges. The vulnerability persists across all listed versions, as the logic error is foundational to the identifier resolution architecture used in those releases."
}