Executive brief
IBM Langflow OSS, a tool used to build AI-powered workflows, contains a security flaw that allows users to access data belonging to others. By creating a workflow with specific matching parameters, an unauthorized user can view private documents or inject their own data into another user's private collection. This could lead to the exposure of sensitive information or the corruption of AI model data.
Technical details
A vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.1 stems from absent user scoping in persistent Chroma and FAISS vector store namespaces. An authenticated attacker can exploit this by creating a flow with 'persist_directory' and 'collection_name' values that match those of a victim. This allows the attacker to retrieve the victim's private document content in their own workflow output or insert unauthorized documents into the victim's collection (data pollution). The issue is resolved in version 1.10.2.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.1
Timeline
- 2026-07-14: advisory: Initial publication by IBM
- 2026-07-30: disclosed: NVD publication date