CVE-2026-107366
Received Received - Intake

IBM Langflow OSS Message Ownership Bypass Vulnerabilities

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-107366
EUVD
EUVD-2026-104676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IBM Langflow OSS 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.12.4 have three message endpoints lacking ownership verification. Authenticated users can delete others' messages, overwrite message content to inject malicious prompts, or hijack conversations by reassigning session IDs.

Impact Analysis

An attacker with access could delete your messages, alter conversations to introduce harmful content, or take over your active sessions, potentially leading to data loss, misinformation, or unauthorized actions.

Compliance Impact

This vulnerability could violate data integrity and confidentiality requirements under GDPR and HIPAA. Unauthorized message deletion or alteration may breach compliance, while session hijacking could expose sensitive data to unauthorized parties.

Mitigation Strategies

Upgrade IBM Langflow OSS to a version beyond 1.12.4 where the vulnerability is patched. Ensure only authorized users have access to authenticated endpoints and monitor for unusual message deletions or modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart