CVE-2026-10700: Langflow IDOR — MEDIUM

CISO Take

Two file-handling endpoints in Langflow — IBM's low-code AI agent builder — fail to enforce proper access control: one skips authentication entirely, the other checks that a user is logged in but never verifies they actually own the flow_id and file_name they're requesting, a textbook IDOR (CWE-639). Any attacker who can reach the API can pull images tied to other users' flows without credentials, and any authenticated low-privilege user can walk flow_id/file_name pairs to reach files belonging to other tenants, breaking tenant isolation outright. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale, but exploitation requires no special skill (AC:L, UI:N) and Langflow already carries 89 other CVEs, reflecting a broad, recurring attack surface with a package risk score of 77/100. If you run Langflow multi-tenant — especially with RAG pipelines or agent flows ingesting customer documents — treat exposed instances as a live confidentiality risk: patch past 1.8.4 per IBM's advisory, and until then restrict network access to the file API and audit logs for cross-user flow_id/file_name requests.

Sources: NVD IBM vendor advisory (ibm.com) ATLAS

What is the risk?

Medium severity (CVSS 6.5, C:H/I:N/A:N) but the practical risk is higher than the score suggests in multi-tenant deployments: the /images/ endpoint requires zero authentication (AV:N/AC:L/PR:N/UI:N in effect), and the /download/ endpoint's missing ownership check turns any low-privileged account into a cross-tenant file reader. No active exploitation is confirmed (not in CISA KEV, no EPSS score, no public PoC or Nuclei template), which lowers urgency for a rushed emergency patch, but the low complexity and lack of required user interaction mean a working exploit is trivial to script once a target instance and valid flow_id are known. Langflow's track record of 89 other CVEs and a package risk score of 77/100 indicate this project has a persistent pattern of security gaps, which should factor into how much trust is placed in self-hosted, internet-facing instances.

How does the attack unfold?

Reconnaissance

Attacker locates an exposed Langflow instance and obtains or guesses a valid flow_id (via public flow links, listings, or predictable identifiers).

AML.T0006

Exploitation

Attacker calls the unauthenticated /api/v1/files/images/ endpoint, or an authenticated low-privilege attacker calls /api/v1/files/download/ with another user's flow_id/file_name, bypassing ownership checks.

AML.T0049

Data exfiltration

Attacker retrieves images, documents, or artifacts belonging to other users' or tenants' flows, breaking tenant isolation and exposing potentially sensitive AI pipeline data.

AML.T0025

Reconnaissance

Attacker locates an exposed Langflow instance and obtains or guesses a valid flow_id (via public flow links, listings, or predictable identifiers).

AML.T0006

Exploitation

Attacker calls the unauthenticated /api/v1/files/images/ endpoint, or an authenticated low-privilege attacker calls /api/v1/files/download/ with another user's flow_id/file_name, bypassing ownership checks.

AML.T0049

Data exfiltration

Attacker retrieves images, documents, or artifacts belonging to other users' or tenants' flows, breaking tenant isolation and exposing potentially sensitive AI pipeline data.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 4d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade past Langflow OSS 1.8.4 per IBM's advisory (https://www.ibm.com/support/pages/node/7279675) as soon as a patched release is available and verified. Until patched, do not expose the Langflow API directly to the internet — front it with a reverse proxy that enforces its own authentication/authorization and restricts access to the /api/v1/files/images/ and /api/v1/files/download/ paths to trusted networks. For multi-tenant deployments, treat all existing flow_id-linked files as potentially exposed and rotate/re-scope any sensitive uploaded documents. Detection: review access logs for requests to /api/v1/files/images/{flow_id}/{file_name} without a prior authenticated session, and for /api/v1/files/download/ requests where the flow_id doesn't belong to the requesting user — both are strong IOCs for this specific abuse pattern.

How is it classified?

Auth Bypass Data Leakage Framework API AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-10700?

Two file-handling endpoints in Langflow — IBM's low-code AI agent builder — fail to enforce proper access control: one skips authentication entirely, the other checks that a user is logged in but never verifies they actually own the flow_id and file_name they're requesting, a textbook IDOR (CWE-639). Any attacker who can reach the API can pull images tied to other users' flows without credentials, and any authenticated low-privilege user can walk flow_id/file_name pairs to reach files belonging to other tenants, breaking tenant isolation outright. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale, but exploitation requires no special skill (AC:L, UI:N) and Langflow already carries 89 other CVEs, reflecting a broad, recurring attack surface with a package risk score of 77/100. If you run Langflow multi-tenant — especially with RAG pipelines or agent flows ingesting customer documents — treat exposed instances as a live confidentiality risk: patch past 1.8.4 per IBM's advisory, and until then restrict network access to the file API and audit logs for cross-user flow_id/file_name requests.

Is CVE-2026-10700 actively exploited?

No confirmed active exploitation of CVE-2026-10700 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-10700?

Upgrade past Langflow OSS 1.8.4 per IBM's advisory (https://www.ibm.com/support/pages/node/7279675) as soon as a patched release is available and verified. Until patched, do not expose the Langflow API directly to the internet — front it with a reverse proxy that enforces its own authentication/authorization and restricts access to the /api/v1/files/images/ and /api/v1/files/download/ paths to trusted networks. For multi-tenant deployments, treat all existing flow_id-linked files as potentially exposed and rotate/re-scope any sensitive uploaded documents. Detection: review access logs for requests to /api/v1/files/images/{flow_id}/{file_name} without a prior authenticated session, and for /api/v1/files/download/ requests where the flow_id doesn't belong to the requesting user — both are strong IOCs for this specific abuse pattern.

What systems are affected by CVE-2026-10700?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, low-code/no-code AI builders, multi-tenant SaaS deployments.

What is the CVSS score for CVE-2026-10700?

CVE-2026-10700 has a CVSS v3.1 base score of 6.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelineslow-code/no-code AI buildersmulti-tenant SaaS deployments

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/{flow_id}/{file_name} endpoint does not enforce authentication or authorization checks, allowing unauthenticated remote attackers to retrieve image files associated with any flow by specifying a valid flow_id and file_name.Additionally, the /api/v1/files/download/{flow_id}/{file_name} endpoint requires authentication but fails to properly validate ownership of the requested resource. As a result, an authenticated user can access files belonging to other users by supplying arbitrary identifiers, leading to an authorization bypass (IDOR).Successful exploitation may result in unauthorized disclosure of sensitive data, including files stored in private flows. This issue breaks tenant isolation in multi-user deployments.

Exploitation Scenario

An attacker locates an internet-facing Langflow instance (many are exposed via default configs or dev deployments left public) and obtains or brute-forces a valid flow_id — potentially leaked via a shared flow link, a public flow listing, or sequential/guessable identifiers. Using the unauthenticated /api/v1/files/images/{flow_id}/{file_name} endpoint, the attacker retrieves image assets tied to that flow with no login required. In a more targeted scenario, an attacker who already holds a low-privileged account on the same multi-tenant Langflow instance enumerates flow_id/file_name combinations against the authenticated /api/v1/files/download/ endpoint, harvesting files — RAG source documents, generated outputs, or business data — belonging to other tenants, effectively defeating the platform's tenant-isolation guarantees.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.