Executive Summary

CVE-2026-7528 is a vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.0 that allows unauthenticated users to upload unlimited files to the server via a deprecated API endpoint without any authentication or validation.

This happens because the /api/v1/upload/{flow_id} endpoint lacks authentication checks and does not validate the flow_id parameter, enabling attackers with network access to repeatedly upload files using any UUID.

As a result, attackers can cause uncontrolled resource consumption, specifically disk space exhaustion, leading to a denial of service (DoS). Additionally, the vulnerability can lead to information disclosure through absolute file path leakage in API responses.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to exhaust the server's disk space through unlimited file uploads, causing a denial of service (DoS) that disrupts normal operations.

Furthermore, the vulnerability can expose sensitive information by leaking absolute file paths in API responses, which could aid attackers in further exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual or excessive file upload activity to the Langflow OSS server, specifically targeting the deprecated /api/v1/upload/{flow_id} endpoint without authentication.

Commands to detect this may include network traffic inspection or web server access log analysis to identify repeated POST requests to the /api/v1/upload/ endpoint with various UUIDs.

• Use tools like curl or wget to test the endpoint manually, for example: curl -X POST http://<server>/api/v1/upload/<flow_id> -F 'file=@testfile'
• Check web server logs for repeated POST requests to /api/v1/upload/ with different flow_id values.
• Use network monitoring tools (e.g., tcpdump, Wireshark) to capture and analyze traffic targeting the vulnerable endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Langflow OSS to version 1.9.2, which addresses the vulnerability.

Additional recommended mitigations are:

• Add authentication to the /api/v1/upload/{flow_id} endpoint to prevent unauthenticated uploads.
• Implement upload rate limiting and size restrictions to control resource consumption.
• Validate the flow_id parameter against existing flows to prevent arbitrary file uploads.
• Modify API responses to return only relative paths or filenames to prevent information disclosure.

Useful 0 Not Useful 0