Executive brief
Langflow, a platform for building AI agents and workflows, contains a security flaw where users can access or delete data belonging to other users. By knowing a specific resource ID, any logged-in user can read private chat histories, modify messages, or delete entire workflow sessions and build logs. This could lead to the exposure of sensitive AI prompts and responses, as well as the corruption of critical business workflows.
Technical details
Langflow's `/api/v1/monitor` router fails to perform ownership validation across seven different endpoints (GET, PUT, PATCH, and DELETE). While the application correctly implements ownership checks in one specific endpoint, the vulnerable endpoints in `monitor.py` accept `flow_id`, `message_id`, or `session_id` parameters without verifying that the `current_user` owns the associated resource. An authenticated attacker can exploit this to perform unauthorized CRUD operations on messages, sessions, build artifacts, and LLM transaction logs. The vulnerability is classified as IDOR/BOLA (Broken Object Level Authorization) and is resolved in version 1.9.0.
Affected products
- langflow-ai Langflow < 1.9.0
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date