CVE-2026-104316: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.
Other sources
Langflow OSS could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS 1.12.4.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker can exploit it over the network. The issue affects access control for running background workflow jobs, so the attacker does not need flow-level permission for the victim's job.
What is the impact of successful exploitation?
An attacker can cancel another user's running background workflow job with a single HTTP request. This causes loss of the in-progress compute work for that job; no confidentiality or integrity impact is specified.
Which versions are affected?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are identified as affected.