{"id":"CVE-2026-104316","kind":"vulnerability","aliases":["CVE-2026-104316"],"related":[],"title":"Langflow: any logged-in user can cancel other users' running workflows","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.","summary":"Langflow OSS versions 1.0.0 through 1.12.3 lack a permission check on the endpoint that cancels background workflow jobs. An attacker with a valid account can stop another user's running flow with one HTTP request, losing that work in progress.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","langflow","self-hosted"],"not_affected_if":["single-user-instance","version-above-1.12.3"],"how_to_check":"- Check the installed Langflow version, for example with `pip show langflow` or the image tag in your deployment.\n- Confirm whether multiple user accounts can log in to your Langflow instance.","fix":"- Move Langflow OSS to a version later than `1.12.3`; the source does not name the exact fixed release.","status":"open","published_at":"2026-10-29T16:17:43+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:31:26+00:00","updated_at":"2026-10-29T16:31:26+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:31:26Z","model":"claude-haiku-5-5","output":{"fix":"- Move Langflow OSS to a version later than `1.12.3`; the source does not name the exact fixed release.","reach":"network","title":"Langflow: any logged-in user can cancel other users' running workflows","impact":"low","summary":"Langflow OSS versions 1.0.0 through 1.12.3 lack a permission check on the endpoint that cancels background workflow jobs. An attacker with a valid account can stop another user's running flow with one HTTP request, losing that work in progress.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","ai-agents"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other users' running workflow jobs are cancelled, losing in-progress work.","analyst_note":"Confirm the fixed Langflow OSS version and check the IBM advisory referenced by the NVD entry for the exact patched release.","how_to_check":"- Check the installed Langflow version, for example with `pip show langflow` or the image tag in your deployment.\n- Confirm whether multiple user accounts can log in to your Langflow instance.","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-instance","version-above-1.12.3"],"who_is_affected":"Teams running self-hosted Langflow OSS from 1.0.0 through 1.12.3 where more than one user has an account. Exposure requires an authenticated account, and the impact is cancelled background jobs rather than code execution or data theft. Single-user or non-Langflow deployments can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4119,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104316':15A,18A '-2026':14A,17A '1.0.0':32B,72C '1.12.3':34B,74C 'account':52B 'agent':21B 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'allow':76C 'anoth':55B 'attack':48B,79C 'authent':78C 'background':44B,86C 'cancel':8A,43B,81C 'check':38B,110C 'comput':102C 'could':75C 'cve':13A,16A 'endpoint':41B 'flow':59B,107C 'flow-level':106C 'host':28B 'http':62B,93C 'ibm':69C 'in-progress':99C 'job':46B,88C 'lack':35B 'langflow':1A,25B,29B,70C 'level':108C 'log':4A 'logged-in':3A 'lose':64B 'loss':97C 'one':61B 'oss':30B,71C 'permiss':37B,109C 'progress':68B,101C 'request':63B,94C 'result':95C 'run':11A,58B,85C 'self':27B 'self-host':26B 'send':90C 'singl':92C 'stop':54B 'tool':24B 'user':6A,10A,56B 'valid':51B 'version':31B 'victim':83C 'work':66B,103C 'workflow':12A,45B,87C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Langflow OSS from 1.0.0 through 1.12.3 where more than one user has an account. Exposure requires an authenticated account, and the impact is cancelled background jobs rather than code execution or data theft. Single-user or non-Langflow deployments can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104316","severity":null,"published_at":"2026-10-29T16:17:43+00:00","modified_at":"2026-10-29T16:17:43+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}