Executive brief
IBM Langflow OSS, a tool used for building AI and machine learning workflows, contains a security flaw that allows unauthorized access to user chat histories. By exploiting this vulnerability, an attacker can bypass security controls to view or modify sensitive information belonging to other users. This could lead to the exposure of private data or intellectual property contained within AI interactions.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Langflow OSS 'POST /api/v1/build_public_tmp/{flow_id}/flow' endpoint. The root cause is a session ID namespace bypass where the 'inputs.session' parameter can override the session ID used during flow execution without proper isolation. When a public flow uses a Memory component with an empty session_id field, it defaults to the caller-supplied ID. An unauthenticated attacker can provide arbitrary session IDs—which are often predictable as they default to the flow's UUID—to retrieve stored chat history from other users' sessions. The issue is resolved in version 1.9.2.
Affected products
- IBM Langflow OSS 1.0.0 through 1.9.1
Timeline
- 2026-06-08: advisory: Initial publication by IBM
- 2026-06-11: disclosed: NVD publication date