CVE-2026-12945: Langflow IDOR exposes/manipulates

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a broken access control flaw (CWE-639) that lets any authenticated user — even a low-privileged one — view and manipulate other users' build jobs, exploiting improper authorization on log retrieval and unauthenticated build endpoints. This matters most for shared or multi-tenant Langflow deployments, where flow build logs commonly surface LLM provider API keys, embedded credentials, prompts, and RAG source content that were never meant to cross user boundaries. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't showing signs of active exploitation — but the attack path itself is low-complexity (AC:L, no user interaction) and only requires an ordinary low-privilege account, making it easy to weaponize once discovered. Patch to a fixed release per IBM's advisory as soon as one is confirmed, and in the meantime audit who has accounts on shared Langflow instances, restrict network exposure of build/log endpoints, and rotate any secrets that may have appeared in cross-tenant build logs.

Sources: NVD CISA KEV ATLAS ibm.com

What is the risk?

CVSS 7.1 (High) reflects a high-confidentiality, low-availability, no-integrity profile: an attacker with any valid low-privileged account can read other users' build job logs and interfere with their builds, but cannot directly tamper with data or achieve code execution through this flaw alone. Real-world risk today is moderate — no KEV listing, no EPSS data, and no public exploit code or scanner coverage suggest exploitation isn't yet widespread — but the low attack complexity and lack of required user interaction mean this could be automated quickly once a proof-of-concept surfaces. The real driver of risk is deployment context: single-tenant, network-isolated Langflow instances are low risk, while shared multi-user instances (common in enterprise AI platform teams) face meaningful cross-tenant information disclosure exposure, especially where flow logs contain embedded secrets or proprietary prompt/RAG content.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a valid low-privileged Langflow account on a shared instance.

AML.T0012

Discovery

Attacker enumerates build job IDs against log retrieval and unauthenticated build endpoints to find other users' jobs.

AML.T0084

Exploitation

Improper access control lets the attacker retrieve and manipulate build jobs belonging to other users without authorization.

AML.T0049

Impact

Sensitive data such as API keys, credentials, and proprietary prompt/RAG content is disclosed, and other users' builds may be disrupted.

Initial Access

Attacker obtains or already holds a valid low-privileged Langflow account on a shared instance.

AML.T0012

Discovery

Attacker enumerates build job IDs against log retrieval and unauthenticated build endpoints to find other users' jobs.

AML.T0084

Exploitation

Improper access control lets the attacker retrieve and manipulate build jobs belonging to other users without authorization.

AML.T0049

Impact

Sensitive data such as API keys, credentials, and proprietary prompt/RAG content is disclosed, and other users' builds may be disrupted.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 4d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A Low

What should I do?

1 step

Upgrade IBM Langflow OSS to the fixed release referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7279994) as soon as a patched version is confirmed available beyond 1.10.1. Until patched, avoid shared multi-tenant Langflow deployments — run per-team or per-project instances, and place build/log endpoints behind network segmentation or a reverse proxy enforcing per-user access checks. Audit existing build logs for any exposed API keys, credentials, or sensitive prompt/RAG content and rotate anything that may have been cross-exposed. Monitor build/log endpoint access patterns for requests referencing job IDs outside a user's own session as a detection signal.

How is it classified?

Auth Bypass Data Leakage Framework Agent AML.T0012 - Valid Accounts AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-12945?

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a broken access control flaw (CWE-639) that lets any authenticated user — even a low-privileged one — view and manipulate other users' build jobs, exploiting improper authorization on log retrieval and unauthenticated build endpoints. This matters most for shared or multi-tenant Langflow deployments, where flow build logs commonly surface LLM provider API keys, embedded credentials, prompts, and RAG source content that were never meant to cross user boundaries. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't showing signs of active exploitation — but the attack path itself is low-complexity (AC:L, no user interaction) and only requires an ordinary low-privilege account, making it easy to weaponize once discovered. Patch to a fixed release per IBM's advisory as soon as one is confirmed, and in the meantime audit who has accounts on shared Langflow instances, restrict network exposure of build/log endpoints, and rotate any secrets that may have appeared in cross-tenant build logs.

Is CVE-2026-12945 actively exploited?

No confirmed active exploitation of CVE-2026-12945 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12945?

Upgrade IBM Langflow OSS to the fixed release referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7279994) as soon as a patched version is confirmed available beyond 1.10.1. Until patched, avoid shared multi-tenant Langflow deployments — run per-team or per-project instances, and place build/log endpoints behind network segmentation or a reverse proxy enforcing per-user access checks. Audit existing build logs for any exposed API keys, credentials, or sensitive prompt/RAG content and rotate anything that may have been cross-exposed. Monitor build/log endpoint access patterns for requests referencing job IDs outside a user's own session as a detection signal.

What systems are affected by CVE-2026-12945?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM application build pipelines.

What is the CVSS score for CVE-2026-12945?

CVE-2026-12945 has a CVSS v3.1 base score of 7.1 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM application build pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

Exploitation Scenario

A contractor or low-privilege employee with an ordinary account on a shared internal Langflow instance enumerates sequential or predictable build job identifiers against the log retrieval endpoint, some of which don't even require authentication. They retrieve build logs belonging to other teams' in-development agent flows, which include a hardcoded OpenAI API key left in a debug print statement and snippets of a proprietary RAG prompt template. Using the same access control gap, they also cancel a colleague's in-progress build job, disrupting that team's agent development pipeline — all without needing elevated privileges or any interaction from the victims.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.