Executive brief
IBM Langflow OSS, a tool for building AI applications, contains security flaws in how it handles file access. These vulnerabilities allow unauthorized individuals to view or download images and data files belonging to other users. In environments where multiple teams or customers share the same installation, this could lead to the exposure of sensitive documents and private project data.
Technical details
IBM Langflow OSS is affected by two distinct access control issues within its file handling API. The first is a lack of authentication on the `/api/v1/files/images/{flow_id}/{file_name}` endpoint, which allows unauthenticated remote attackers to retrieve image files by guessing or obtaining valid flow and file identifiers. The second is an Insecure Direct Object Reference (IDOR) vulnerability in the `/api/v1/files/download/{flow_id}/{file_name}` endpoint; while this endpoint requires authentication, it fails to verify if the requesting user owns the flow associated with the file. Together, these flaws break tenant isolation in multi-user deployments, potentially exposing sensitive data stored in private flows. Users are advised to upgrade to Langflow v1.9.0 or later.
Affected products
- IBM Langflow OSS 1.0.0 - 1.8.4
Timeline
- 2026-07-09: advisory: Initial publication by IBM
- 2026-07-30: disclosed: NVD publication date