Authorization bypass through user-controlled key in Langflow - CVE-2026-105698

Vulnerability details

The vulnerability allows a remote user to disclose private flow structure and vertex outputs and trigger unauthorized execution of another user's flow vertices.

The vulnerability exists due to missing flow ownership checks in the deprecated Langflow chat API endpoints POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} when handling requests with user-controlled flow identifiers. A remote user can submit direct HTTP requests containing a known target flow UUID to enumerate its vertices and execute individual vertices, retrieving their outputs and triggering configured side effects.

Global variables and credentials in the variable store are not exposed because variable resolution uses the caller's user ID.

Affected software

How to mitigate CVE-2026-105698

External References

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw
• https://github.com/langflow-ai/langflow/commit/fb3d6ec90b

Related Security Bulletins

• Multiple vulnerabilities in Langflow