Description

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T22:16:47.470Z",
  "pubdate": "2026-08-28T22:16:47.470Z",
  "executiveSummary": "A critical improper authorization vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.11.1.\nThis vulnerability allows a remote, authenticated attacker to bypass intended access controls and gain unauthorized access to private flows belonging to other users within the system.\nThe security flaw stems from insufficient validation of ownership or authorization checks when processing requests for flow resources.\nBy manipulating requests, an attacker can both read and execute arbitrary flows regardless of the original owner's permission settings.\nThe impact is significant, as it leads to potential unauthorized disclosure of proprietary logic, credentials, or sensitive data embedded within these flows.\nAs the vulnerability requires authentication, it highlights a failure in the application's internal access control logic rather than an entry-point authentication bypass.\nOrganizations deploying IBM Langflow within these version ranges are at risk of data exfiltration and unauthorized command execution.",
  "technicalDetails": "The vulnerability resides within the authorization logic of the IBM Langflow OSS framework, affecting versions 1.0.0 through 1.11.1. The root cause is identified as an improper authorization flaw, where the backend application fails to strictly enforce user-space separation when querying or executing flow definitions.\nSpecifically, the application's API endpoints responsible for flow management do not adequately verify that the authenticated session requesting a specific flow ID possesses the requisite ownership permissions or valid access rights to that resource. Instead of implementing a server-side check that validates the association between the authenticated user's ID (or session token) and the requested flow resource ID in the database, the system processes the request based solely on the presence of a valid session.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the IBM Langflow instance using their own valid, low-privileged account. 2) The attacker intercepts or reconstructs requests aimed at endpoints such as those managing flow retrieval (GET) or flow execution (POST). 3) By modifying the flow identifier parameter within these requests to correspond to a flow owned by another user, the attacker submits the request to the server. 4) The server, lacking an ownership validation layer, treats the request as legitimate, granting the attacker full read access to the victim's private flow structure or allowing the attacker to execute the flow with the context of the system's privileges.\nBecause flows can contain sensitive environment variables, connection strings, or internal application logic, this vulnerability effectively allows an attacker to bypass logical access boundaries. The exploit does not require elevated privileges; any authenticated user can target any flow in the system. Post-exploitation, an attacker could exfiltrate sensitive data, gain insights into the victim's organizational workflows, or trigger malicious logic execution if the flow is designed to interact with external systems or databases. The vulnerability impacts all deployments where user isolation is a prerequisite for security, and it demonstrates a failure to implement the principle of least privilege at the application object level."
}