Executive brief
IBM Langflow OSS, a tool used for building and managing AI workflows, contains a security flaw that allows unauthorized users to access sensitive data. An attacker can view private information such as API keys, customer prompts, and internal documents, or disrupt operations by canceling active AI tasks. This could lead to significant data exposure and service interruptions for organizations using the platform.
Technical details
A missing authentication vulnerability exists in the /api/v1/build_public_tmp/ endpoints of IBM Langflow OSS versions 1.0.0 through 1.9.6. The affected endpoints, specifically GET /build_public_tmp/{job_id}/events and POST /build_public_tmp/{job_id}/cancel, lack the necessary 'Depends(get_current_active_user)' checks and authorization lookups. An unauthenticated remote attacker with knowledge of a valid job identifier can stream live build events—exposing API keys, LLM responses, and filesystem paths—or cancel in-flight builds to cause a denial of service. The issue is resolved in Langflow OSS version 1.10.0.
Affected products
- IBM Langflow OSS 1.0.0 through 1.9.6
Timeline
- 2026-06-25: advisory: Initial publication by IBM
- 2026-06-30: disclosed: NVD publication date
- 2026-06-30: patched: Remediation available in version 1.10.0