CVE-2026-105698: Langflow: missing flow ownership check exposes private flows

Q: Is CVE-2026-105698 actively exploited?

No confirmed active exploitation of CVE-2026-105698 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-105698?

1) Upgrade langflow to 1.10.1 and langflow-base to 0.10.1 or later. 2) If patching is delayed, block or filter POST /api/v1/build/{flow_id}/vertices and /vertices/{vertex_id} at the reverse proxy or WAF; these endpoints are deprecated. 3) Do not expose Langflow directly to the internet; require authentication, and prefer SSO or a VPN. 4) Detection: review access logs for calls to the vertices endpoints where the authenticated user does not own the flow_id, for unauthenticated calls on versions up to 1.7.1, and for unusual build-history entries. 5) Rotate any secrets or API keys placed directly in flow component fields (as opposed to the variable store), since their configured values may have been disclosed. 6) Treat flow UUIDs as non-secret, and do not rely on them for access control.

Q: What systems are affected by CVE-2026-105698?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM workflow orchestration, RAG pipelines, Multi-tenant AI application platforms.

Q: What is the CVSS score for CVE-2026-105698?

CVE-2026-105698 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.22%.

GHSA-gh98-4phw-6fmwMEDIUMCISA: TRACK*

Published October 5, 2026

CISO Take

Langflow's deprecated vertex build endpoints did not verify flow ownership, so any caller who knew another user's flow UUID could read that flow's structure and configured values and run selected components. Before 1.7.2 the caller needed no authentication, and from 1.7.2 through 1.10.0 any low-privilege account was enough. The blast radius is limited: there is no public exploit, no Nuclei template, no KEV listing, and EPSS is 0.00177 (top 93% percentile). The advisory also says variable-store credentials were not exposed and the stored flow could not be modified. Flow UUIDs must be known or guessed, which lowers mass-exploitation risk. Still, the flaw can leak prompts, tool configs and outputs, and can trigger victim-configured side effects. Upgrade to langflow 1.10.1 (langflow-base 0.10.1) and restrict access to the deprecated endpoints until then.

Sources:NVDGitHub AdvisoryEPSSATLASlangflow-ai/langflow GitHub release notes

What is the risk?

Medium (CVSS 5.4). The attack is network-based, low complexity, needs no user interaction, and needs at most low privileges. The main limiter is that the caller must know a target flow UUID. Confidentiality and integrity impact are both low: the flaw can disclose flow structure, configured values and selected outputs, and can execute chosen vertices, but credentials in the variable store are not exposed and stored flows cannot be altered. Exposure is highest on multi-tenant or internet-facing Langflow deployments with many users, and unauthenticated reachability exists only on versions up to 1.7.1. Exploitation likelihood is low-to-moderate: EPSS is 0.00177 with no public exploit, no scanner template and no KEV listing. The package has 194 other CVEs and a risk score of 77/100, which points to a recurring pattern of security debt.

How does the attack unfold?

Initial Access

Attacker obtains a victim's flow UUID and calls the deprecated vertices endpoint, unauthenticated on versions up to 1.7.1 or with any low-privilege account on 1.7.2 through 1.10.0.

AML.T0049

Discovery

The handler loads and caches the private graph without an owner check, and the attacker enumerates its vertex identifiers and structure.

AML.T0084

Execution

The attacker calls build_vertex on selected vertices to run victim components and receive their outputs.

AML.T0053

Impact

Private flow configuration and outputs leak, and the victim's configured side effects and build-history records are triggered.

AML.T0085.001

Initial Access

Attacker obtains a victim's flow UUID and calls the deprecated vertices endpoint, unauthenticated on versions up to 1.7.1 or with any low-privilege account on 1.7.2 through 1.10.0.

AML.T0049

Discovery

The handler loads and caches the private graph without an owner check, and the attacker enumerates its vertex identifiers and structure.

AML.T0084

Execution

The attacker calls build_vertex on selected vertices to run victim components and receive their outputs.

AML.T0053

Impact

Private flow configuration and outputs leak, and the victim's configured side effects and build-history records are triggered.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	>= 1.0.0, < 1.10.1	`1.10.1`
156.0KPushed 6d ago18% patched~66d to patchFull package profile →
Langflow	pip	< 0.10.1	`0.10.1`
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade langflow to 1.10.1 and langflow-base to 0.10.1 or later. 2) If patching is delayed, block or filter POST /api/v1/build/{flow_id}/vertices and /vertices/{vertex_id} at the reverse proxy or WAF; these endpoints are deprecated. 3) Do not expose Langflow directly to the internet; require authentication, and prefer SSO or a VPN. 4) Detection: review access logs for calls to the vertices endpoints where the authenticated user does not own the flow_id, for unauthenticated calls on versions up to 1.7.1, and for unusual build-history entries. 5) Rotate any secrets or API keys placed directly in flow component fields (as opposed to the variable store), since their configured values may have been disclosed. 6) Treat flow UUIDs as non-secret, and do not rely on them for access control.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0084- Discover AI Agent Configuration AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-105698?

Is CVE-2026-105698 actively exploited?

No confirmed active exploitation of CVE-2026-105698 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105698?

1) Upgrade langflow to 1.10.1 and langflow-base to 0.10.1 or later. 2) If patching is delayed, block or filter POST /api/v1/build/{flow_id}/vertices and /vertices/{vertex_id} at the reverse proxy or WAF; these endpoints are deprecated. 3) Do not expose Langflow directly to the internet; require authentication, and prefer SSO or a VPN. 4) Detection: review access logs for calls to the vertices endpoints where the authenticated user does not own the flow_id, for unauthenticated calls on versions up to 1.7.1, and for unusual build-history entries. 5) Rotate any secrets or API keys placed directly in flow component fields (as opposed to the variable store), since their configured values may have been disclosed. 6) Treat flow UUIDs as non-secret, and do not rely on them for access control.

What systems are affected by CVE-2026-105698?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM workflow orchestration, RAG pipelines, Multi-tenant AI application platforms.

What is the CVSS score for CVE-2026-105698?

CVE-2026-105698 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM workflow orchestrationRAG pipelinesMulti-tenant AI application platforms

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0084Discover AI Agent Configuration

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and receive their results. build_graph_from_db_no_cache performed a primary-key lookup without an owner filter. This could disclose private flow structure, configured values, and selected outputs and could trigger victim-configured side effects and build-history records, although it did not expose the victim's variable-store credentials or permit modification of the stored flow. This issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1.

Exploitation Scenario

An attacker with a low-privilege account on a shared Langflow server (or, on versions up to 1.7.1, no account at all) obtains a target flow UUID from a leaked URL, shared screenshot, logs or a colleague's link. They send POST /api/v1/build/{flow_id}/vertices to load the private graph and list its vertex IDs. They then call the vertex build endpoint on chosen components, for example a retriever or an API-call node, and read the returned outputs, which may include proprietary prompts, internal documents or API responses. Running those vertices also triggers the victim's configured actions, such as external API calls and LLM usage costs.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-862Missing AuthorizationPrimary CWE-862Missing AuthorizationPrimary CWE-639Authorization Bypass Through User-Controlled Key CWE-862Missing Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.