CVE-2026-13444: Langflow IDOR exposes/poisons

CISO Take

IBM Langflow, the open-source visual builder for LLM and agent workflows, fails to enforce ownership on the persist_directory and collection_name identifiers used to address a user's Chroma vector store, so any authenticated user who guesses or replicates those values receives another user's private embedded documents verbatim in their own flow output — and can additionally write poisoned documents into that shared namespace. No CVSS score, EPSS percentile, or CISA KEV status has been assigned yet and no public exploit or Nuclei template exists, but the flaw requires no privileges beyond a normal Langflow account and no interaction from the victim, so it is trivially repeatable once an attacker learns the naming convention. For any multi-tenant Langflow deployment backing a RAG pipeline, this is a direct confidentiality and integrity breach of the knowledge base — proprietary documents, PII, or compliance-sensitive records embedded for retrieval can leak across customer or team boundaries, and the same path lets an attacker corrupt a victim's retrieval results. Upgrade past 1.10.1 (to the first release that namespaces Chroma collections per user/tenant) and, in the interim, audit multi-tenant deployments for shared Chroma persist directories and enforce per-tenant collection prefixes or isolated Chroma instances.

Sources: NVD ATLAS ibm.com OWASP

What is the risk?

Exploitability is high in relative terms: the attacker needs only a normal, non-privileged Langflow account, no victim interaction, and no complex tooling — just knowledge or a guess of the victim's persist_directory/collection_name pair. No CVSS vector, EPSS score, KEV listing, public exploit, or Nuclei template currently exist, so there is no evidence of active exploitation, but the trivial reproduction steps described by IBM mean weaponization is straightforward for anyone with access to a shared Langflow instance. Impact is significant where it applies: full-fidelity disclosure of another tenant's embedded content plus write access to poison that tenant's future retrievals — a combined confidentiality and integrity failure. Exposure is concentrated in multi-tenant or shared-hosting Langflow deployments (SaaS builders, internal platforms serving multiple teams/customers); single-tenant, single-user installs are effectively unaffected.

How does the attack unfold?

Namespace Discovery

Attacker with a legitimate Langflow account identifies or guesses the persist_directory and collection_name values used to address a target's Chroma vector store.

AML.T0064

Malicious Flow Creation

Attacker builds their own Langflow flow with a Chroma component configured to point at the same persist_directory/collection_name as the victim's flow.

AML.T0085.000

Data Exfiltration

Running the attacker's flow returns the victim's exact private embedded documents in the attacker's own workflow output.

AML.T0085.000

Collection Poisoning

Attacker writes crafted documents into the shared Chroma collection, corrupting the victim's future RAG retrievals and downstream LLM outputs.

AML.T0070

Namespace Discovery

Attacker with a legitimate Langflow account identifies or guesses the persist_directory and collection_name values used to address a target's Chroma vector store.

AML.T0064

Malicious Flow Creation

Attacker builds their own Langflow flow with a Chroma component configured to point at the same persist_directory/collection_name as the victim's flow.

AML.T0085.000

Data Exfiltration

Running the attacker's flow returns the victim's exact private embedded documents in the attacker's own workflow output.

AML.T0085.000

Collection Poisoning

Attacker writes crafted documents into the shared Chroma collection, corrupting the victim's future RAG retrievals and downstream LLM outputs.

AML.T0070

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 4d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade Langflow past 1.10.1 to the version that scopes persist_directory/collection_name to the authenticated user or tenant. 2) Until patched, audit existing Chroma persist directories/collections for naming collisions across users and enforce unique, non-guessable identifiers (e.g., tenant ID + random UUID prefix) at the infrastructure or reverse-proxy layer. 3) Isolate Chroma storage per tenant (separate persist directories, containers, or database instances) rather than relying on Langflow's application-layer scoping. 4) Add monitoring/alerting on Chroma collection access patterns that don't match the flow owner's user ID. 5) For any collection that may have been exposed, treat its contents as compromised — rotate/re-embed and review for injected documents before trusting future retrievals.

How is it classified?

Auth Bypass Data Leakage Privacy Violation Framework RAG Plugin AML.T0064 - Gather RAG-Indexed Targets AML.T0070 - RAG Poisoning AML.T0085.000 - RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.7.4 - Data provenance

OWASP LLM Top 10

LLM08:2025 - Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-13444?

IBM Langflow, the open-source visual builder for LLM and agent workflows, fails to enforce ownership on the persist_directory and collection_name identifiers used to address a user's Chroma vector store, so any authenticated user who guesses or replicates those values receives another user's private embedded documents verbatim in their own flow output — and can additionally write poisoned documents into that shared namespace. No CVSS score, EPSS percentile, or CISA KEV status has been assigned yet and no public exploit or Nuclei template exists, but the flaw requires no privileges beyond a normal Langflow account and no interaction from the victim, so it is trivially repeatable once an attacker learns the naming convention. For any multi-tenant Langflow deployment backing a RAG pipeline, this is a direct confidentiality and integrity breach of the knowledge base — proprietary documents, PII, or compliance-sensitive records embedded for retrieval can leak across customer or team boundaries, and the same path lets an attacker corrupt a victim's retrieval results. Upgrade past 1.10.1 (to the first release that namespaces Chroma collections per user/tenant) and, in the interim, audit multi-tenant deployments for shared Chroma persist directories and enforce per-tenant collection prefixes or isolated Chroma instances.

Is CVE-2026-13444 actively exploited?

No confirmed active exploitation of CVE-2026-13444 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13444?

1) Upgrade Langflow past 1.10.1 to the version that scopes persist_directory/collection_name to the authenticated user or tenant. 2) Until patched, audit existing Chroma persist directories/collections for naming collisions across users and enforce unique, non-guessable identifiers (e.g., tenant ID + random UUID prefix) at the infrastructure or reverse-proxy layer. 3) Isolate Chroma storage per tenant (separate persist directories, containers, or database instances) rather than relying on Langflow's application-layer scoping. 4) Add monitoring/alerting on Chroma collection access patterns that don't match the flow owner's user ID. 5) For any collection that may have been exposed, treat its contents as compromised — rotate/re-embed and review for injected documents before trusting future retrievals.

What systems are affected by CVE-2026-13444?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, agent frameworks, multi-tenant SaaS AI platforms.

What is the CVSS score for CVE-2026-13444?

CVE-2026-13444 has a CVSS v3.1 base score of 8.1 (HIGH).

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesagent frameworksmulti-tenant SaaS AI platforms

MITRE ATLAS Techniques

AML.T0064 Gather RAG-Indexed Targets

AML.T0070 RAG Poisoning

AML.T0085.000 RAG Databases

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

Exploitation Scenario

An attacker with a legitimate but low-privilege account on a shared Langflow instance observes or guesses the naming convention used for Chroma persist_directory and collection_name (e.g., derived from a predictable project or workspace name). They build their own flow, configure its Chroma component with those same coordinates, and run a retrieval node — the flow returns the victim's exact private embedded documents as if they were the attacker's own data, exfiltrating potentially sensitive knowledge-base content with no alert to the victim. The attacker can then insert crafted documents into that same collection, silently poisoning the victim's future RAG retrievals so the victim's LLM outputs begin incorporating attacker-controlled content.

Weaknesses (CWE)

CWE-520 .NET Misconfiguration: Use of Impersonation Primary

CWE-520 — .NET Misconfiguration: Use of Impersonation: Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.