Executive brief
IBM Langflow OSS, a tool used for building multi-agent AI applications, contains a vulnerability that allows unauthorized users to upload an unlimited number of files. This can lead to the server running out of disk space, causing the application to crash or become unavailable. Additionally, the system may reveal internal file paths to attackers, potentially exposing information about the server's configuration.
Technical details
A vulnerability in the deprecated /api/v1/upload/{flow_id} endpoint of Langflow OSS allows for uncontrolled resource consumption (CWE-400). The endpoint, located in langflow/api/v1/endpoints.py, fails to perform authentication checks or validate the flow_id, permitting attackers to upload arbitrary files using any UUID. This can result in disk space exhaustion on the host server. Furthermore, the API responses include absolute file paths, leading to information disclosure. The issue is resolved in version 1.9.2 by implementing authentication, rate limiting, and path sanitization.
Affected products
- IBM Langflow OSS 1.0.0 through 1.9.0
Timeline
- 2026-05-19: disclosed: Initial publication of security bulletin by IBM
- 2026-05-19: patched: Version 1.9.2 released to address the vulnerability
- 2026-05-27: advisory: NVD publication date