CVE-2026-105698

Received Received - Intake

Unauthenticated Flow Data Exposure in Langflow

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and receive their results. build_graph_from_db_no_cache performed a primary-key lookup without an owner filter. This could disclose private flow structure, configured values, and selected outputs and could trigger victim-configured side effects and build-history records, although it did not expose the victim's variable-store credentials or permit modification of the stored flow. This issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105698

Affected Vendors & Products

Vendor	Product	Version / Range
langflow-ai	langflow	>= 1.0.0, < 1.10.1
langflow-ai	langflow-base	< 0.10.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Langflow versions 1.0.0 to 1.10.1 had a flaw where flow ownership was not verified in certain API handlers. Unauthenticated users could access these handlers in older versions, while newer versions required authentication but no special privileges. Attackers could exploit this to view private flow details, execute specific parts of a flow, and trigger side effects without modifying the flow or accessing credentials.

Detection Guidance

Detecting this vulnerability requires checking if your Langflow instance is running a vulnerable version (1.0.0 to 1.10.1). Inspect the version by examining the Langflow logs or running commands like 'pip show langflow' or 'langflow --version' in your environment.

Impact Analysis

If you used Langflow versions 1.0.0 to 1.10.1, an attacker could discover your private flow structure, configured values, and outputs. They could also execute parts of your flow, potentially causing unintended side effects or leaving traces in build history. This does not allow credential theft or flow modification.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data within flows, potentially violating GDPR (data protection) or HIPAA (health information privacy) if such data was processed. Exposure of flow structure or outputs may constitute a compliance breach depending on the data involved.

Mitigation Strategies

Upgrade Langflow to version 1.10.1 or later and langflow-base to 0.10.1 or later. This fixes the flow ownership verification issue. If immediate upgrade is not possible, restrict network access to the affected endpoints or disable them until patched.

Hi! I’m here to help you understand CVE-2026-105698. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70