CVE-2026-107366

Awaiting Analysis Awaiting Analysis - Queue

IBM Langflow OSS Message Ownership Bypass Vulnerabilities

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-03

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-107366

EUVD

EUVD-2026-104676

Affected Vendors & Products

Vendor	Product	Version / Range
langflow	langflow	From 1.0.0 (inc) to 1.12.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.12.4 have three message endpoints lacking ownership verification. Authenticated users can delete others' messages, overwrite message content to inject malicious prompts, or hijack conversations by reassigning session IDs.

Detection Guidance

To detect this vulnerability, check for unauthorized message deletions, content modifications, or session ID reassignments in IBM Langflow OSS logs. Monitor endpoints for bulk operations on messages by non-owners. Verify if authenticated users can access or alter messages outside their permissions.

Impact Analysis

An attacker with access could delete your messages, alter conversations to introduce harmful content, or take over your active sessions, potentially leading to data loss, misinformation, or unauthorized actions.

Compliance Impact

This vulnerability could violate data integrity and confidentiality requirements under GDPR and HIPAA. Unauthorized message deletion or alteration may breach compliance, while session hijacking could expose sensitive data to unauthorized parties.

Mitigation Strategies

Upgrade IBM Langflow OSS to a version beyond 1.12.4 where the vulnerability is patched. Ensure only authorized users have access to authenticated endpoints and monitor for unusual message deletions or modifications.

Hi! I’m here to help you understand CVE-2026-107366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...