CVE-2026-107366
8.3HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-639
Impact
Authenticated attackers can tamper with, overwrite, or bulk-delete other users' messages and hijack active conversation sessions. They only need standard authenticated network access to the Langflow instance.
Root cause
Three message endpoints lack ownership verification, allowing insecure direct object reference (IDOR) attacks.
Affected systems
IBM Langflow OSS 1.0.0 through 1.12.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Fix & remediation
Upgrade to a version newer than 1.12.4 once available. If patching must wait, restrict network access to trusted users or disable public registration on the instance.
$ pip install --upgrade langflowAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.