CVE-2026-105698: Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flowid}/vertices and POST /api/v1/build/{flowid}/vertices/{vertexid} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieveverticesorder to load and cache the private graph, enumerate its vertex identifiers, and use buildvertex to execute selected vertices and receive their results. buildgraphfromdbnocache performed a primary-key lookup without an owner filter. This could disclose private flow structure, configured values, and selected outputs and could trigger victim-configured side effects and build-history records, although it did not expose the victim's variable-store credentials or permit modification of the stored flow. This issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflowto a version that resolves this vulnerability.Fixed in 1.10.1 - Upgrade
Upgrade
langflow-baseto a version that resolves this vulnerability.Fixed in 0.10.1
Event History
Frequently Asked Questions
Which deployments are exposed without authentication?
Langflow versions through 1.7.1 allowed unauthenticated access to the affected handlers when the caller knew another user's flow UUID. From 1.7.2 through 1.10.0, the caller needed to authenticate, but no elevated privileges were required.
What does an attacker need to exploit this issue?
The attacker needs the UUID of a target user's flow and access to the deprecated build endpoint. Depending on the version, that access is either unauthenticated or requires only a regular authenticated account.
What could an attacker obtain or trigger?
An attacker could load and cache a private flow graph, enumerate vertex identifiers, execute selected vertices, and receive their results. This could disclose flow structure, configured values, and selected outputs, and may trigger victim-configured side effects and build-history records; it does not expose variable-store credentials or allow modification of the stored flow.
What version resolves the issue?
Upgrade Langflow to 1.10.1 and langflow-base to 0.10.1. The affected Langflow range is 1.0.0 through 1.10.0.