CVE-2026-9130 Overview
CVE-2026-9130 is an authorization bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw resides in the MemoryComponent, where the retrieve_messages and store_message methods filter chat history solely by session_id without validating flow_id or user_id ownership. Authenticated users can trigger a session_id collision to access chat history belonging to other users. The issue is reachable through multiple authenticated API endpoints, including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. The vulnerability only affects multi-user deployments configured with LANGFLOW_AUTO_LOGIN=False.
Critical Impact
Authenticated attackers can read chat history of other users across shared Langflow deployments, resulting in cross-tenant information disclosure of potentially sensitive AI workflow data.
Affected Products
- IBM Langflow OSS 1.0.0 through 1.10.3
- Multi-user Langflow deployments with LANGFLOW_AUTO_LOGIN=False
- Langflow API endpoints /api/v1/run/*, /api/v1/responses, /api/v2/workflow/*
Discovery Timeline
- 2026-08-05 - CVE-2026-9130 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-9130
Vulnerability Analysis
The MemoryComponent in IBM Langflow OSS manages chat history persistence for AI flows. Its retrieve_messages and store_message methods query the message store using only session_id as a filter. The methods do not cross-check the calling user's user_id or the associated flow_id against the record owner. When two users share or guess an identical session_id, one user can retrieve messages written by another. This is a broken access control issue [CWE-285] combined with insecure direct object reference [CWE-639] semantics on the session_id value.
Root Cause
The authorization model assumes session_id is a private, unguessable identifier scoped per user. The persistence layer never enforces that assumption. Because the value is accepted from client-controlled request parameters across multiple endpoints, callers can set or reuse arbitrary session_id strings. The missing ownership check on flow_id and user_id allows the collision to translate directly into cross-user data access.
Attack Vector
An authenticated user issues a request to /api/v1/run/*, /api/v1/responses, or /api/v2/workflow/* and supplies a session_id known or guessed to belong to another user. The MemoryComponent returns messages tied to that session_id regardless of the requester's identity. No user interaction from the victim is required, and the attack is fully remote against the Langflow API. Refer to the IBM Support Page for vendor technical details.
Detection Methods for CVE-2026-9130
Indicators of Compromise
- Requests to /api/v1/run/*, /api/v1/responses, or /api/v2/workflow/* where the supplied session_id does not match values previously observed for the authenticated user.
- Repeated API calls from a single user iterating through many distinct session_id values in a short window.
- Chat history reads on flows the requesting user does not own or has never invoked before.
Detection Strategies
- Correlate user_id from authenticated sessions with the session_id values submitted to memory-related endpoints and alert on mismatches.
- Baseline typical session_id patterns per user and flag deviations, especially sequential or enumerated identifiers.
- Monitor Langflow application logs for MemoryComponent.retrieve_messages invocations that return records created by a different user_id.
Monitoring Recommendations
- Enable verbose API access logging on all Langflow endpoints that accept session_id as a parameter.
- Forward Langflow application and reverse proxy logs to a central analytics platform for cross-user correlation.
- Track anomalous read volume on chat history endpoints per authenticated identity.
How to Mitigate CVE-2026-9130
Immediate Actions Required
- Upgrade IBM Langflow OSS to a version later than 1.10.3 that addresses the MemoryComponent authorization check.
- Audit deployments for the LANGFLOW_AUTO_LOGIN=False setting and treat those instances as prioritized for patching.
- Rotate or invalidate existing session_id values after upgrading to prevent replay of previously exposed identifiers.
- Review chat history stores for evidence of cross-user access prior to patching.
Patch Information
IBM has published remediation guidance on the IBM Support Page. Administrators should apply the vendor-provided fixed version of Langflow OSS above 1.10.3 and validate that MemoryComponent methods enforce flow_id and user_id ownership checks after upgrade.
Workarounds
- Restrict Langflow multi-user deployments to trusted users only until patched, reducing the population able to abuse the endpoint.
- Place Langflow behind a reverse proxy that enforces per-user session_id scoping or rejects requests where session_id does not match a server-known value for the authenticated user.
- Avoid sharing Langflow instances across tenants or business units where chat history contains sensitive data until the upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
