Live › vulnerability › CVE-2026-107366
Go to dashboardThree message endpoints in IBM Langflow OSS 1.0.0 through 1.12.4 do not check who owns the messages they act on. An authenticated user can bulk-delete other users' messages, overwrite message content to inject prompts, or take over a conversation by reassigning its session ID.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.4 with more than one user account on the same instance. The risk depends on any authenticated user being able to reach the message endpoints, so single-user or trusted-user deployments are less exposed. Teams on managed hosting should check with their provider.
No product ranges from the sources yet.
langflow --version or pip show langflow, and look for versions from 1.0.0 through 1.12.4.1.12.4; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
This page as .md · .json · in your agent: get_signal("CVE-2026-107366")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.