CVE-2026-107366 in Langflow OSS
Summary
by MITRE • 10/20/2026
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in IBM Langflow versions 1.0.0 through 1.12.4 represents a critical failure in access control mechanisms within the application's message handling subsystems. Specifically, three distinct API endpoints designed for managing chat messages lack proper ownership verification logic. In a secure implementation of such systems, any operation that modifies or deletes data associated with a specific user context must strictly validate that the authenticated actor initiating the request is indeed the owner of that data. The absence of this validation allows an attacker who has obtained valid credentials to manipulate resources belonging to other users on the same instance. This flaw fundamentally undermines the principle of least privilege and fails to enforce proper isolation between tenant or user contexts, which is a baseline requirement for any multi-user application handling sensitive conversational data.
The operational impact of these flaws is severe due to the specific actions enabled by the missing checks. First, an authenticated attacker can perform bulk deletion of messages belonging to other users. This action results in a denial of service condition where legitimate users lose access to their historical conversation logs and context, potentially disrupting workflows that rely on this data for continuity or audit purposes. Second, the ability to overwrite message content allows for prompt injection attacks against other users. By modifying existing messages within a victim's session, an attacker can alter the instructions provided to the underlying large language model. This could lead to the leakage of sensitive information contained in previous turns, forced execution of malicious code if function calling is enabled, or manipulation of the AI's behavior to produce harmful outputs. Third, the capability to hijack conversation sessions by reassigning session IDs enables an attacker to take over active interactions. By linking their own actions to a victim's session ID, the attacker can continue conversations as that user, potentially gaining access to context-specific information or performing actions under the victim's identity within the application logic.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and more specifically CWE-639 Authorization Bypass Through User-Controlled Key. The core issue is not that authentication fails, but that authorization checks are missing or incorrectly implemented for resource-specific operations. In the context of the MITRE ATT&CK framework, these actions map to techniques such as T1078 Valid Accounts, where an attacker uses legitimate credentials to gain access, and T1530 Data from Information Repositories if data is exfiltrated via prompt injection or session hijacking. The bulk deletion aspect also relates to T1485 Data Destruction. These classifications highlight that the vulnerability exploits a gap in server-side validation rather than client-side security measures, making it particularly dangerous as it cannot be mitigated by simple frontend restrictions.
Mitigation strategies must prioritize immediate patching of IBM Langflow to version 1.12.5 or later where these ownership checks have been implemented. For environments where upgrading is not immediately feasible, network-level controls can provide partial mitigation. Implementing strict API gateway rules that validate user identity against resource ownership metadata before forwarding requests to the application backend may help block unauthorized operations. Additionally, enabling comprehensive audit logging for all message modification and deletion events allows security teams to detect anomalous patterns indicative of exploitation attempts. It is also recommended to review session management practices to ensure that session IDs are generated using cryptographically secure random values and are bound strictly to the authenticated user's context on the server side, preventing ID reuse or hijacking regardless of endpoint vulnerabilities.