Executive brief
IBM Langflow OSS is a visual workflow platform for building generative AI applications. The product fails to properly redact sensitive credential fields (such as API keys and authentication tokens) when returning public flow configurations to unauthenticated users. An attacker who knows a public flow's identifier and the owner's user ID can retrieve stored credentials, potentially gaining unauthorized access to integrated services and sensitive data.
Technical details
The vulnerability is an information exposure flaw (CWE-200) in Langflow's public flow endpoint. The product attempts to scrub sensitive credentials from node templates using a heuristic denylist of common credential field names, but this list is incomplete and omits fields such as Authentication, X-Session-Id, App-Key, and JWT. An unauthenticated attacker can call the public flow endpoint with knowledge of a public flow ID and owner user ID to retrieve the flow configuration, which may contain unredacted sensitive values in plaintext. The attack requires no authentication, no user interaction, and is network-accessible. IBM has released version 1.11.3 with fixes; affected versions are 1.0.0 through 1.11.2.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Version 1.11.3 available