CVE-2026-107366: Langflow OSS Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
Other sources
Three message endpoints perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.5 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.5.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Langflow OSS user can exploit it. The issue does not require user interaction and is reachable over the network.
Which deployments are affected?
IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected. The description identifies missing ownership verification on three message endpoints, rather than a feature that must be explicitly enabled.
What could an attacker do after exploiting it?
An authenticated attacker can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or reassign a session ID to hijack an entire conversation session.