CVE-2026-10547 in Langflow OSS
Summary
by MITRE • 08/05/2026
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within IBM Langflow Open Source Software versions 1.0.0 through 1.10.3 where the deprecated POST /api/v1/build/{flow_id}/vertices endpoint fails to properly validate ownership permissions. The flaw stems from inadequate input validation mechanisms that allow authenticated users to manipulate workflow graph data within shared caching systems. When a user submits graph data through this endpoint, the system does not verify whether the requesting user has legitimate authorization to modify the target flow, creating a critical access control weakness. This vulnerability maps to CWE-285: Improper Authorization and aligns with ATT&CK technique T1078: Valid Accounts which exploits legitimate user credentials to gain unauthorized access to resources.
The technical implementation of this flaw occurs because the endpoint accepts flow_id parameters without performing proper ownership checks against the authenticated user session. Any authenticated user can potentially inject arbitrary graph vertices into any flow's shared cache by simply knowing a valid flow identifier, regardless of whether they own that specific workflow or have proper authorization rights. This cross-user cache pollution enables attackers to manipulate shared resources in ways that were never intended by the application design. The system's caching mechanism becomes vulnerable to unauthorized modifications where one user can affect another user's workflow execution environment through the injection of malicious graph data.
The operational impact of this vulnerability extends beyond simple data corruption or unauthorized access. Attackers can leverage this weakness to execute unauthorized workflows, potentially causing denial of service conditions when shared cache resources become polluted with malicious data. The cross-user nature of the vulnerability means that a compromised user account could affect multiple other users within the same system, creating cascading effects that might disrupt legitimate workflow operations. Additionally, the injection of arbitrary graph data could lead to unexpected behavior in downstream processing systems that rely on these cached workflows, potentially causing system instability or unauthorized execution of unintended operations.
Mitigation strategies should focus on implementing proper ownership validation checks before allowing any modification to shared cache resources. The endpoint must verify that authenticated users have appropriate permissions to modify the target flow_id before accepting graph data injection requests. Organizations should immediately disable or remove the deprecated POST /api/v1/build/{flow_id}/vertices endpoint from production environments until proper authorization controls are implemented. System administrators should also implement monitoring solutions to detect unusual cache modification patterns that might indicate exploitation attempts. The recommended approach aligns with security best practices outlined in NIST SP 800-53 and ISO/IEC 27001 standards for access control management, ensuring that all resource modifications are properly authenticated and authorized through robust permission validation mechanisms.