CVE-2026-104316: Langflow: missing authz lets users cancel others' jobs

MEDIUM

Published October 29, 2026

CISO Take

Langflow OSS 1.0.0 through 1.12.3 has a missing authorization check (CWE-285) that lets any authenticated user cancel another user's running background workflow job with a single HTTP request. The impact is limited to availability (loss of in-progress compute work), with no confidentiality or integrity impact, and the CVSS score is 6.5 (medium). There is no EPSS score, no public exploit, no Nuclei template, and it is not in CISA KEV, so near-term exploitation pressure looks low. The risk is highest on shared, multi-tenant Langflow deployments where long-running or costly flows (batch ingestion, agent runs) are executed by different teams. Apply the fix described in the IBM advisory (ibm.com/support/pages/node/7293015), upgrade beyond 1.12.3, and restrict Langflow account provisioning until patched.

Sources:NVDibm.com

What is the risk?

Medium. The attack is network-reachable, low complexity, needs only a low-privilege account and no user interaction. Impact is limited to availability of individual jobs. No public exploit, no KEV listing, and EPSS is unavailable, so likelihood of active exploitation is low to moderate. Risk is higher for shared instances with many users or where jobs consume expensive compute or LLM API credits, and where a disgruntled insider or compromised low-privilege account is plausible.

How does the attack unfold?

Initial Access

Attacker obtains or uses a low-privilege authenticated account on a shared Langflow instance.

AML.T0012

Discovery

Attacker identifies the job ID of a victim's running background workflow.

Exploitation

Attacker sends a single HTTP cancel request; the server skips the flow-level permission check (CWE-285).

Impact

Victim's in-progress job is terminated, causing lost compute work and disrupted AI pipelines.

AML.T0029

Initial Access

Attacker obtains or uses a low-privilege authenticated account on a shared Langflow instance.

AML.T0012

Discovery

Attacker identifies the job ID of a victim's running background workflow.

Exploitation

Attacker sends a single HTTP cancel request; the server skips the flow-level permission check (CWE-285).

Impact

Victim's in-progress job is terminated, causing lost compute work and disrupted AI pipelines.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade Langflow to a release newer than 1.12.3 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7293015. 2) Until patched, limit Langflow access to trusted users, disable open self-registration, and place the instance behind SSO or a VPN. 3) Use network or reverse-proxy rules to restrict access to the job cancellation endpoint where feasible. 4) Monitor logs for unexpected cancel requests where the requesting user does not own the job, and for unexplained job terminations. 5) Review accounts with access and remove unused or low-trust ones.

How is it classified?

Auth BypassDoSFrameworkAgentAML.T0012- Valid Accounts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from AI system issues

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-104316?

Is CVE-2026-104316 actively exploited?

No confirmed active exploitation of CVE-2026-104316 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104316?

1) Upgrade Langflow to a release newer than 1.12.3 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7293015. 2) Until patched, limit Langflow access to trusted users, disable open self-registration, and place the instance behind SSO or a VPN. 3) Use network or reverse-proxy rules to restrict access to the job cancellation endpoint where feasible. 4) Monitor logs for unexpected cancel requests where the requesting user does not own the job, and for unexplained job terminations. 5) Review accounts with access and remove unused or low-trust ones.

What systems are affected by CVE-2026-104316?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-104316?

CVE-2026-104316 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.

Exploitation Scenario

An attacker with a low-privilege account on a shared Langflow instance (a contractor, or a compromised user credential) enumerates or guesses job identifiers for running background workflows. They send a single cancel request for a victim's job ID, and the server cancels it without checking flow-level ownership. By repeating this, they continually kill other teams' long-running RAG ingestion or agent jobs, wasting compute and LLM API spend and disrupting automated pipelines.

Weaknesses (CWE)

CWE-285Improper AuthorizationPrimary CWE-285Improper Authorization

CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.

Source: MITRE CWE corpus.