Executive brief
IBM Langflow OSS is a visual development tool for building AI workflows. The voice-mode feature contains an authorization flaw that allows an authenticated user to read other users' workflow descriptions and inject fake messages into their conversation history in multi-user deployments. While workflow execution remains protected, this vulnerability enables unauthorized data access and message tampering for any authenticated attacker who knows a target flow's identifier.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the voice-mode WebSocket endpoint. The endpoint authenticates the user and validates the presence of a personal OpenAI API key, but fails to perform authorization checks to verify the user has permission to access the specified flow (identified via URL path parameter). An authenticated attacker can supply any flow identifier to read the flow's description field and inject messages into the workflow's conversation history. The injected messages are subsequently visible to the flow owner via the message monitor API. Flow execution is unaffected as it applies a separate authorization check. The vulnerability affects versions 1.0.0 through 1.10.2 and is fixed in version 1.10.3.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.2
Timeline
- 2026-09-04: disclosed
- 2026-09-03: patched: Fix available in version 1.10.3