CVE-2026-105698: Langflow Information Disclosure Vulnerability

CVE-2026-105698 Overview

Langflow is an open-source tool for building and deploying AI-powered agents and workflows. CVE-2026-105698 is an Insecure Direct Object Reference ([CWE-639]) vulnerability affecting Langflow versions 1.0.0 through 1.10.0. The deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers failed to verify flow ownership. A caller who knew another user's flow UUID could enumerate vertex identifiers, execute selected vertices, and receive their results. The issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1.

Critical Impact
Attackers can disclose private flow structure, configured values, and selected outputs, and trigger victim-configured side effects on vulnerable Langflow deployments.

Affected Products

Langflow versions 1.0.0 through 1.7.1 (unauthenticated access possible)
Langflow versions 1.7.2 through 1.10.0 (requires low-privileged authentication)
langflow-base prior to 0.10.1

Discovery Timeline

2026-10-05 - CVE-2026-105698 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105698

Vulnerability Analysis

The flaw resides in two deprecated build handlers in the Langflow API router. The retrieve_vertices_order function loads and caches a graph identified by flow_id without validating that the caller owns the flow. Once cached, build_vertex executes individual vertices against that graph and returns their output to the caller.

From version 1.0.0 through 1.7.1, no authentication was required to reach these endpoints. Starting with 1.7.2, authentication was enforced but no privilege or ownership check followed. Any authenticated low-privileged user could therefore target another tenant's flows.

The disclosure is bounded: the attacker receives flow structure, configured values, and selected vertex outputs, and may trigger side effects baked into the flow. The flaw does not expose variable-store credentials and does not permit modification of the stored flow definition.

Root Cause

The underlying helper build_graph_from_db_no_cache performs a primary-key lookup on flow_id without an owner filter. The handlers never add a secondary authorization check tying the authenticated principal to the flow owner, resulting in a classic Insecure Direct Object Reference ([CWE-639]).

Attack Vector

An attacker with network access and knowledge of a target flow UUID issues a POST request to /api/v1/build/{flow_id}/vertices to load and enumerate the graph. The attacker then issues POST /api/v1/build/{flow_id}/vertices/{vertex_id} to execute chosen vertices and collect their outputs.

The fix in pull request #13153 introduces authorization foundations for enterprise RBAC in the Langflow API router.

python

# Patch excerpt - src/backend/base/langflow/api/router.py
from langflow.api.v1 import (
    api_key_router,
    authz_audit_router,
    authz_shares_router,
    chat_router,
    endpoints_router,
    extensions_router,

Source: GitHub Commit fb3d6ec

Detection Methods for CVE-2026-105698

Indicators of Compromise

Requests to /api/v1/build/{flow_id}/vertices or /api/v1/build/{flow_id}/vertices/{vertex_id} from accounts that do not own the referenced flow_id.
Unexpected build-history entries attributed to flows whose owner did not initiate the build.
Spikes in retrieve_vertices_order cache loads for flow UUIDs across unrelated tenants.

Detection Strategies

Correlate authenticated user IDs with the owner field of the targeted flow_id in reverse-proxy or application logs and alert on mismatches.
Flag unauthenticated POSTs to the deprecated /api/v1/build/* endpoints on versions 1.0.0 through 1.7.1.
Monitor outbound traffic generated by vertex execution for calls that originate from flows the authenticated user does not own.

Monitoring Recommendations

Enable verbose access logging on the Langflow API gateway and ship logs to a centralized analytics platform.
Track invocation counts and output sizes per flow_id to identify enumeration behavior.
Audit build-history records against the user who initiated them to detect cross-tenant builds.

How to Mitigate CVE-2026-105698

Immediate Actions Required

Upgrade Langflow to version 1.10.1 and langflow-base to 0.10.1.
Restrict network exposure of the Langflow API to trusted users via VPN, SSO proxy, or network ACLs.
Rotate any secrets or outbound tokens referenced by flows that may have been executed by unauthorized callers.

Patch Information

The fix landed in Langflow Release v1.10.1 via Pull Request #13153, which introduces OSS authorization foundations for enterprise RBAC. See the GitHub Security Advisory GHSA-gh98-4phw-6fmw for full details.

Workarounds

Block the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} routes at a reverse proxy if an immediate upgrade is not possible.
Require authentication at the proxy layer for deployments running versions prior to 1.7.2.
Limit flow UUID visibility by removing shared logs, screenshots, or exports that could leak identifiers.

bash

# Example nginx block for the deprecated build endpoints
location ~ ^/api/v1/build/[^/]+/vertices {
    return 403;
}