CVE-2026-10560: Langflow missing auth on build

CISO Take

IBM's Langflow — an open-source low-code builder for LLM and agent workflows — ships with build-status endpoints under /api/v1/build_public_tmp/ that never verify who is asking, so anyone who obtains a valid job identifier can read another user's build event data or cancel their in-progress builds without ever logging in. For a CISO, the practical risk is a network-reachable, zero-privilege, zero-interaction bug (CVSS 9.1, AV:N/AC:L/PR:N/UI:N) on a widely deployed agent-orchestration framework that can leak flow execution details — a plausible route to exposed prompts, tool outputs, or configuration fragments — and can be abused to repeatedly cancel legitimate jobs as a low-effort denial-of-service. Tempering the urgency: EPSS sits at just 0.27% (though that ranks in the 81st percentile relative to other CVEs), it isn't in CISA KEV, and there's no public exploit or Nuclei template yet, so this reads as unpatched-and-exposed rather than actively exploited today. Any team running Langflow OSS 1.0.0–1.9.6 as an internet-facing or multi-tenant service should upgrade past 1.9.6 immediately, and until patched should wall off /api/v1/build_public_tmp/ behind network controls (VPN, reverse-proxy auth, IP allowlist) and watch logs for anonymous read or cancel calls against that path.

Sources: NVD EPSS CISA KEV ATLAS ibm.com

What is the risk?

CVSS 9.1 (critical) reflects a genuinely trivial exploitation path — network-reachable, no authentication, no privileges, no user interaction, and full confidentiality plus availability impact (C:H/A:H) once a valid job identifier is in hand. However, current exploitation likelihood is low: EPSS is 0.00272 (absolute probability well under 1%), the CVE is not in CISA KEV, no public exploit code or Nuclei template has surfaced, and package-level risk telemetry (OpenSSF Scorecard, GitHub push recency) is unavailable to corroborate active targeting. Net assessment: high potential impact if an instance is internet-exposed, but moderate-to-low near-term likelihood of opportunistic mass exploitation — this should be prioritized as a patch-now item for any public-facing or multi-tenant Langflow deployment, not treated as an active-incident trigger.

How does the attack unfold?

Discovery

Attacker locates an internet-exposed Langflow instance and identifies the unauthenticated /api/v1/build_public_tmp/ endpoints, then obtains or guesses a valid build job identifier.

AML.T0006

Unauthenticated Exploitation

Using only the job ID and no credentials, the attacker calls the endpoint to read build event data or issue a job-cancel request.

AML.T0049

Information Disclosure

Build event data returned to the attacker may expose flow structure, model/tool configuration, or intermediate outputs belonging to another user or tenant.

AML.T0007

Service Disruption

Repeated unauthenticated cancel calls terminate legitimate users' in-progress builds, degrading availability of the AI workflow platform.

AML.T0029

Discovery

Attacker locates an internet-exposed Langflow instance and identifies the unauthenticated /api/v1/build_public_tmp/ endpoints, then obtains or guesses a valid build job identifier.

AML.T0006

Unauthenticated Exploitation

Using only the job ID and no credentials, the attacker calls the endpoint to read build event data or issue a job-cancel request.

AML.T0049

Information Disclosure

Build event data returned to the attacker may expose flow structure, model/tool configuration, or intermediate outputs belonging to another user or tenant.

AML.T0007

Service Disruption

Repeated unauthenticated cancel calls terminate legitimate users' in-progress builds, degrading availability of the AI workflow platform.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A High

What should I do?

1 step

Upgrade Langflow OSS to a version beyond 1.9.6 as soon as a fixed release is confirmed (check the IBM advisory and Langflow's GitHub release notes for the exact patched version). Until patched: place /api/v1/build_public_tmp/* behind authentication at the reverse proxy or gateway layer (basic auth, mTLS, or IP allowlisting), restrict the instance to an internal network/VPN if public exposure isn't required, and disable or hide any 'public build/share' feature that isn't actively needed. For detection, monitor access logs for unauthenticated 2xx responses to build_public_tmp endpoints and alert on repeated cancel-job calls that don't correlate with an authenticated session, which would indicate probing or active abuse.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Data Leakage Framework Agent AML.T0007 - Discover AI Artifacts AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.3 - AI risk treatment

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-10560?

IBM's Langflow — an open-source low-code builder for LLM and agent workflows — ships with build-status endpoints under /api/v1/build_public_tmp/ that never verify who is asking, so anyone who obtains a valid job identifier can read another user's build event data or cancel their in-progress builds without ever logging in. For a CISO, the practical risk is a network-reachable, zero-privilege, zero-interaction bug (CVSS 9.1, AV:N/AC:L/PR:N/UI:N) on a widely deployed agent-orchestration framework that can leak flow execution details — a plausible route to exposed prompts, tool outputs, or configuration fragments — and can be abused to repeatedly cancel legitimate jobs as a low-effort denial-of-service. Tempering the urgency: EPSS sits at just 0.27% (though that ranks in the 81st percentile relative to other CVEs), it isn't in CISA KEV, and there's no public exploit or Nuclei template yet, so this reads as unpatched-and-exposed rather than actively exploited today. Any team running Langflow OSS 1.0.0–1.9.6 as an internet-facing or multi-tenant service should upgrade past 1.9.6 immediately, and until patched should wall off /api/v1/build_public_tmp/ behind network controls (VPN, reverse-proxy auth, IP allowlist) and watch logs for anonymous read or cancel calls against that path.

Is CVE-2026-10560 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-10560, increasing the risk of exploitation.

How to fix CVE-2026-10560?

Upgrade Langflow OSS to a version beyond 1.9.6 as soon as a fixed release is confirmed (check the IBM advisory and Langflow's GitHub release notes for the exact patched version). Until patched: place /api/v1/build_public_tmp/* behind authentication at the reverse proxy or gateway layer (basic auth, mTLS, or IP allowlisting), restrict the instance to an internal network/VPN if public exposure isn't required, and disable or hide any 'public build/share' feature that isn't actively needed. For detection, monitor access logs for unauthenticated 2xx responses to build_public_tmp endpoints and alert on repeated cancel-job calls that don't correlate with an authenticated session, which would indicate probing or active abuse.

What systems are affected by CVE-2026-10560?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM application builders, multi-tenant AI workflow platforms.

What is the CVSS score for CVE-2026-10560?

CVE-2026-10560 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM application buildersmulti-tenant AI workflow platforms

MITRE ATLAS Techniques

AML.T0007 Discover AI Artifacts

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.3

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

Exploitation Scenario

An organization exposes an internal Langflow instance to the internet to demo or embed AI workflows without adding authentication in front of it. An attacker discovers the instance via internet scanning or by crawling for the distinctive /api/v1/build_public_tmp/ path, then either intercepts a job ID leaked in client-side JavaScript/URLs or enumerates IDs if they follow a predictable pattern. Using only that identifier and no credentials, the attacker issues GET requests to pull build event data — potentially revealing flow structure, model/tool names, or embedded configuration — and then loops cancel requests against active job IDs, continuously killing legitimate users' or tenants' builds and degrading the service, all without ever authenticating.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.