{"id":"CVE-2026-107366","kind":"vulnerability","aliases":["CVE-2026-107366"],"related":[],"title":"Langflow: message endpoints let any logged-in user alter others' messages","description":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.","summary":"Three message endpoints in IBM Langflow OSS 1.0.0 through 1.12.4 do not check who owns the messages they act on. An authenticated user can bulk-delete other users' messages, overwrite message content to inject prompts, or take over a conversation by reassigning its session ID.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","langflow","multi-user","self-hosted"],"not_affected_if":["single-user-instance","version-outside-range"],"how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`, and look for versions from `1.0.0` through `1.12.4`.\n- Confirm whether multiple user accounts can reach the same Langflow instance.","fix":"- Upgrade Langflow OSS to a release newer than `1.12.4`; the sources do not name the fixed version.\n- Until patched, restrict Langflow access to trusted users only.","status":"open","published_at":"2026-10-20T00:17:25+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:02:27+00:00","updated_at":"2026-10-25T03:02:27+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:02:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Langflow OSS to a release newer than `1.12.4`; the sources do not name the fixed version.\n- Until patched, restrict Langflow access to trusted users only.","reach":"network","title":"Langflow: message endpoints let any logged-in user alter others' messages","impact":"medium","summary":"Three message endpoints in IBM Langflow OSS 1.0.0 through 1.12.4 do not check who owns the messages they act on. An authenticated user can bulk-delete other users' messages, overwrite message content to inject prompts, or take over a conversation by reassigning its session ID.","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","ai-apps","multi-user"],"confidence":0.7,"needs_auth":"yes","worst_case":"Other users' messages deleted, altered, or conversations hijacked by session reassignment","analyst_note":"Find the fixed Langflow version and the affected endpoint paths in the NVD entry or IBM advisory; the sources give neither.","how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`, and look for versions from `1.0.0` through `1.12.4`.\n- Confirm whether multiple user accounts can reach the same Langflow instance.","needs_analyst":true,"not_affected_if":["single-user-instance","version-outside-range"],"who_is_affected":"Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.4 with more than one user account on the same instance. The risk depends on any authenticated user being able to reach the message endpoints, so single-user or trusted-user deployments are less exposed. Teams on managed hosting should check with their provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3321,"output_tokens":632,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107366':15A,18A '-2026':14A,17A '1.0.0':39B,81C '1.12.4':41B,83C 'act':50B 'ai':20B,23B 'ai-app':19B 'ai-tool':22B 'alter':10A 'anoth':100C 'app':21B 'authent':53B,94C 'bulk':57B,98C 'bulk-delet':56B,97C 'check':44B 'contain':84C 'content':64B,106C 'convers':72B,115C 'cve':13A,16A 'delet':58B,99C 'endpoint':3A,34B,87C 'entir':114C 'hijack':112C 'host':31B 'ibm':36B,78C 'id':77B,121C 'inject':66B,108C 'langflow':1A,25B,37B,79C 'let':4A 'log':7A 'logged-in':6A 'malici':109C 'messag':2A,12A,33B,48B,61B,63B,86C,103C,105C 'multi':27B 'multi-us':26B 'oss':38B,80C 'other':11A 'overwrit':62B,104C 'own':46B 'ownership':91C 'perform':89C 'prompt':67B,110C 'reassign':74B,118C 'self':30B 'self-host':29B 'session':76B,116C,120C 'take':69B 'three':32B,85C 'tool':24B 'user':9A,28B,54B,60B,95C,101C 'verif':92C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.4 with more than one user account on the same instance. The risk depends on any authenticated user being able to reach the message endpoints, so single-user or trusted-user deployments are less exposed. Teams on managed hosting should check with their provider.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107366","severity":null,"published_at":"2026-10-20T00:17:25+00:00","modified_at":"2026-10-21T04:17:09+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}