CVE-2026-9130
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The retrieve_messages and store_message methods filter only on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple API endpoints.
Risk Assessment
The risk involves unauthorized access to confidential chat data of other users, potentially violating privacy and confidentiality in multi-user deployments. An attacker could exploit this to steal data or conduct espionage.
Recommendation
It is recommended to immediately upgrade IBM Langflow OSS to a version newer than 1.10.3 if available. Additionally, implement ownership validation (flow_id, user_id) in the MemoryComponent and consider restricting access to sensitive API endpoints.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-93680Critical
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw that could allow a remote attacker to bypass security restrictions.
- CVE-2026-110186Critical
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
- CVE-2026-107329Critical
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
- CVE-2026-107328Critical
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
- CVE-2026-107327Critical
IBM Langflow OSS versions 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
- CVE-2026-104339Critical
IBM Langflow OSS versions 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-12944Critical
IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables AWS credential theft via IMDSv1 SSRF, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
- CVE-2026-81204Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary code due to code injection during graph construction.
- CVE-2026-79724Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-85025Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS