CVE-2026-9130 in Langflow OSS
Summary
by MITRE • 08/05/2026
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in IBM Langflow Open Source Edition versions 1.0.0 through 1.10.3 represents a critical authorization bypass flaw that fundamentally undermines the security model of multi-user deployments. This weakness resides within the MemoryComponent class where session identifiers are used as the primary means of access control without proper validation of user or flow ownership. The issue manifests when authenticated users can manipulate session_id values to gain unauthorized access to chat histories belonging to other users, creating a direct pathway for cross-user information disclosure.
The technical implementation flaw stems from insufficient input validation and inadequate authorization checks within the MemoryComponent's retrieve_messages and store_message methods. These methods rely solely on session_id filtering while completely omitting verification of flow_id or user_id ownership, which creates a fundamental gap in the access control mechanism. This design pattern violates the principle of least privilege and demonstrates a failure to implement proper resource isolation between authenticated users. The vulnerability operates at the application logic level rather than being a network-level issue, making it particularly dangerous as it exploits legitimate authentication mechanisms to gain unauthorized access.
The operational impact of this authorization bypass is severe for organizations deploying IBM Langflow in multi-user environments where LANGFLOW_AUTO_LOGIN=False is configured. Attackers can exploit this weakness through multiple authenticated API endpoints including /api/v1/run/, /api/v1/responses, and /api/v2/workflow/, allowing them to access sensitive chat histories, conversation data, and potentially confidential information exchanged between different users of the platform. This cross-user information disclosure directly violates data privacy principles and could lead to significant reputational damage, regulatory compliance violations, and potential legal consequences for organizations handling sensitive user communications.
The vulnerability aligns with CWE-862 - Missing Authorization and follows ATT&CK technique T1078 - Valid Accounts, as it leverages legitimate authenticated sessions to access unauthorized resources. Organizations using IBM Langflow in multi-user deployments should immediately implement mitigations including enforcing strict session_id validation that includes user and flow ownership checks, implementing proper access control lists, and ensuring all API endpoints validate both session_id and user context before processing requests. Additionally, organizations should consider deploying authentication mechanisms that prevent session_id collision scenarios and implement monitoring for anomalous access patterns in chat history retrieval operations.
This vulnerability highlights the critical importance of robust access control implementation in multi-user applications and demonstrates how seemingly simple authorization checks can create significant security gaps. The issue is particularly concerning in enterprise environments where chat-based applications often handle sensitive information, making proper privilege enforcement essential for maintaining data confidentiality and system integrity. Organizations should prioritize immediate patching or workaround implementation to prevent potential exploitation of this authorization bypass vulnerability.