CVE-2026-6542

Received Received - Intake

IBM Langflow OSS Information Disclosure and Data Deletion Vulnerability

Publication date: 2026-04-30

Last updated on: 2026-05-04

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-30

Last Modified

2026-05-04

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6542

Affected Vendors & Products

Vendor	Product	Version / Range
langflow	langflow	From 1.0.0 (inc) to 1.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.8.4. It allows any user to supply a flow_id and thereby read transaction logs and vertex build data that belong to other users. Additionally, it enables the deletion of persisted vertex build data for another user's flow.

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive transaction logs and vertex build data of other users, potentially exposing confidential information. It also allows malicious users to delete important persisted data belonging to others, which could disrupt operations or cause data loss.

Compliance Impact

This vulnerability allows any user to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow.

Such unauthorized access and deletion of user data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Therefore, this vulnerability potentially compromises confidentiality and integrity of user data, impacting compliance with these common standards.

Hi! I’m here to help you understand CVE-2026-6542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70