CVE-2026-10547: IBM Langflow Auth Bypass Vulnerability

CVE-2026-10547 Overview

CVE-2026-10547 is an improper access control vulnerability [CWE-284] in IBM Langflow OSS versions 1.0.0 through 1.10.3. The deprecated POST /api/v1/build/{flow_id}/vertices endpoint fails to validate ownership of the target flow. Authenticated users can inject arbitrary graph data into the shared cache for any flow they do not own.

Successful exploitation leads to cross-user cache pollution, unauthorized workflow execution, or denial of service against other tenants sharing the Langflow instance. The vulnerability affects multi-user Langflow deployments where flows are isolated per user account.

Critical Impact
An authenticated attacker can pollute shared cache entries for any flow, execute unauthorized workflows on behalf of other users, or disrupt Langflow services.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.3
Deployments exposing the deprecated /api/v1/build/{flow_id}/vertices endpoint
Multi-tenant Langflow instances with authenticated users

Discovery Timeline

2026-08-05 - CVE-2026-10547 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-10547

Vulnerability Analysis

The vulnerability resides in a deprecated build endpoint that accepts vertex graph data for a specified flow_id. The endpoint authenticates the caller but does not verify that the caller owns or is authorized to modify the target flow. Any logged-in user can therefore submit graph payloads targeting flows owned by other users.

Langflow uses a shared in-memory cache to store intermediate build state for flows. When the vulnerable endpoint accepts unauthorized graph data, that data is written into the shared cache entry keyed by flow_id. Subsequent legitimate operations on the flow consume the poisoned cache state.

This leads to three attack outcomes. First, cross-user cache pollution corrupts a victim's workflow definition. Second, unauthorized workflow execution occurs when the poisoned graph triggers downstream execution paths under the victim's context. Third, denial of service results when injected graph data prevents the flow from building or executing.

Root Cause

The root cause is missing authorization enforcement [CWE-284] on the POST /api/v1/build/{flow_id}/vertices route. The handler resolves the flow by flow_id from the URL path and writes to the shared cache without comparing the authenticated principal against the flow's owner. Deprecated code paths retained authentication checks but omitted ownership validation.

Attack Vector

Exploitation requires a valid Langflow account and network access to the API. The attacker sends a crafted POST request to /api/v1/build/{flow_id}/vertices where flow_id identifies a flow belonging to another user. The request body contains attacker-controlled graph vertex data. The server writes the payload to the shared cache without an ownership check, and the poisoned entry affects subsequent operations on the victim's flow. Attack complexity is elevated because the attacker must enumerate or otherwise obtain valid target flow_id values.

No verified public proof-of-concept code exists at time of publication. See the IBM Support Page for vendor-provided technical details.

Detection Methods for CVE-2026-10547

Indicators of Compromise

Unexpected POST requests to /api/v1/build/{flow_id}/vertices where the authenticated user identifier does not match the flow owner recorded in the Langflow database.
Flow build failures, corrupted vertex definitions, or unexpected workflow execution events tied to flows the owning user did not modify.
Repeated calls to the deprecated /api/v1/build/ endpoint from a single account against multiple distinct flow_id values.

Detection Strategies

Correlate Langflow API access logs against the flow ownership table to identify build requests from non-owners.
Alert on any traffic to deprecated endpoints under /api/v1/build/{flow_id}/vertices, which should not be used by current clients.
Monitor cache state transitions and workflow execution outcomes for flows immediately following third-party API access to the same flow_id.

Monitoring Recommendations

Enable verbose API access logging on the Langflow application, including authenticated user identity, request path, and target resource identifier.
Forward Langflow application logs to a centralized analytics platform for correlation with authentication and flow-ownership metadata.
Baseline normal build endpoint usage per user account and alert on deviations such as bursts of requests to unfamiliar flow_id values.

How to Mitigate CVE-2026-10547

Immediate Actions Required

Upgrade IBM Langflow OSS to a version above 1.10.3 that includes the ownership validation fix, per the IBM Support Page.
Restrict Langflow API access to trusted networks and enforce strong authentication for all accounts until patching is complete.
Audit existing flows for signs of unauthorized modification or unexpected vertex definitions.

Patch Information

IBM has published guidance on the IBM Support Page. Administrators should apply the vendor-recommended fixed release for Langflow OSS and review the release notes for related access control changes.

Workarounds

Block or reverse-proxy filter the deprecated POST /api/v1/build/{flow_id}/vertices endpoint if it is not required by client applications.
Reduce the number of authenticated users on shared Langflow instances and isolate high-value flows in dedicated deployments.
Rotate API credentials and invalidate long-lived sessions after upgrading to remove access from previously compromised accounts.

bash

# Example: block the deprecated vertices build endpoint at an NGINX reverse proxy
location ~ ^/api/v1/build/[^/]+/vertices$ {
    return 403;
}