CVE-2026-9130: Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without validating flowid or userid ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/, /api/v1/responses, and /api/v2/workflow/. This vulnerability only affects multi-user deployments with LANGFLOWAUTOLOGIN=False.
Other sources
Langflow OSS contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without validating flowid or userid ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/, /api/v1/responses, and /api/v2/workflow/. This vulnerability only affects multi-user deployments with LANGFLOWAUTOLOGIN=False.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.0 - Configuration
This authorization bypass impacts multi-user deployments when LANGFLOW_AUTO_LOGIN=False; if feasible for your deployment model, set LANGFLOW_AUTO_LOGIN to True to avoid the affected condition.
Langflow OSS LANGFLOW_AUTO_LOGIN = False - Compensating control
If you operate a multi-user deployment, limit authenticated users’ ability to access endpoints that can be used for cross-user disclosure (/api/v1/run/*, /api/v1/responses, /api/v2/workflow/*) by applying strict network/ACL/WAF rules so only authorized users can reach the relevant API endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9130?
CVE-2026-9130 has a severity rating of high with a score of 7.1.
What is CVE-2026-9130 about?
CVE-2026-9130 involves an authorization bypass vulnerability in IBM Langflow OSS that may allow authenticated users to access other users' chat histories.
How do I fix CVE-2026-9130?
To mitigate CVE-2026-9130, users should upgrade IBM Langflow OSS to a patched version beyond 1.10.3.
What components are affected by CVE-2026-9130?
The MemoryComponent of IBM Langflow OSS versions 1.0.0 through 1.10.3 is affected by CVE-2026-9130.
What types of attacks can CVE-2026-9130 facilitate?
CVE-2026-9130 can facilitate arbitrary code execution due to a failure in validating custom component inputs.