AI Threat AlertCVE-2026-17627: Langflow: IDOR leaks and poisons workflow history
HIGHIBM Langflow OSS versions 1.0.0 through 1.10.2 contain an improper authorization flaw (CWE-639) that lets an authenticated, low-privileged user access another user's workflow history and inject fabricated messages into it. In multi-tenant or shared Langflow deployments — common for teams building RAG pipelines and LLM agents — this means one user could read sensitive data surfaced in someone else's workflow (prompts, retrieved context, tool outputs) and tamper with the historical record an agent or downstream process relies on. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei scanner template for this CVE, and the high attack complexity (AC:H) plus scope-changed, confidentiality/integrity-only impact (C:L/I:L/A:N) keeps the CVSS at a moderate 4.9 — this is not an urgent, mass-exploitable bug. Still, any organization running self-hosted Langflow with multiple users or tenants sharing an instance should upgrade past 1.10.2 immediately and, in the interim, audit which accounts can enumerate or access workflow IDs belonging to other users. Detection-wise, watch for API calls retrieving workflow/session objects that don't belong to the requesting user's own workspace.
What is the risk?
Medium risk. Exploitation requires an existing authenticated (low-privileged) account and high attack complexity, meaning this isn't opportunistically exploitable by an anonymous internet attacker — but it is realistic in any multi-tenant or team-shared Langflow deployment, which is Langflow's typical usage pattern for building agentic/RAG workflows. No EPSS data, no KEV listing, no known public exploit or scanner coverage exist yet, so there's no evidence of active or imminent exploitation. The scope-changed CVSS vector (S:C) indicates the flaw can affect resources beyond the vulnerable component's own security scope, which is notable for a workflow-orchestration platform where 'workflow history' often embeds retrieved documents, credentials passed through nodes, or other sensitive pipeline state.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade Langflow OSS to a release beyond 1.10.2 per IBM's advisory as soon as it's available/verified in your environment. Until patched, restrict Langflow instances to single-tenant use or enforce strict network/identity segmentation between users who shouldn't share workflow visibility. Review and harden authorization checks on any custom workflow/session ID handling if self-managing deployments. For detection, audit API/access logs for workflow-history retrieval or message-injection requests referencing workflow IDs outside a user's own project/workspace, and flag any unexpected entries appearing in workflow history that weren't generated by the workflow's own execution.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-17627?
IBM Langflow OSS versions 1.0.0 through 1.10.2 contain an improper authorization flaw (CWE-639) that lets an authenticated, low-privileged user access another user's workflow history and inject fabricated messages into it. In multi-tenant or shared Langflow deployments — common for teams building RAG pipelines and LLM agents — this means one user could read sensitive data surfaced in someone else's workflow (prompts, retrieved context, tool outputs) and tamper with the historical record an agent or downstream process relies on. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei scanner template for this CVE, and the high attack complexity (AC:H) plus scope-changed, confidentiality/integrity-only impact (C:L/I:L/A:N) keeps the CVSS at a moderate 4.9 — this is not an urgent, mass-exploitable bug. Still, any organization running self-hosted Langflow with multiple users or tenants sharing an instance should upgrade past 1.10.2 immediately and, in the interim, audit which accounts can enumerate or access workflow IDs belonging to other users. Detection-wise, watch for API calls retrieving workflow/session objects that don't belong to the requesting user's own workspace.
Is CVE-2026-17627 actively exploited?
No confirmed active exploitation of CVE-2026-17627 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-17627?
Upgrade Langflow OSS to a release beyond 1.10.2 per IBM's advisory as soon as it's available/verified in your environment. Until patched, restrict Langflow instances to single-tenant use or enforce strict network/identity segmentation between users who shouldn't share workflow visibility. Review and harden authorization checks on any custom workflow/session ID handling if self-managing deployments. For detection, audit API/access logs for workflow-history retrieval or message-injection requests referencing workflow IDs outside a user's own project/workspace, and flag any unexpected entries appearing in workflow history that weren't generated by the workflow's own execution.
What systems are affected by CVE-2026-17627?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow orchestration, RAG pipelines.
What is the CVSS score for CVE-2026-17627?
CVE-2026-17627 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.27%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0080.001ThreadAML.T0092Manipulate User LLM Chat HistoryCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.
Exploitation Scenario
In a shared Langflow deployment (e.g., a company's internal AI automation platform), a low-privileged authenticated user — perhaps a contractor or junior team member with a valid but limited account — discovers or guesses the identifier of a workflow belonging to a more privileged colleague. Exploiting the improper authorization check, they retrieve that workflow's history, exposing sensitive data such as API keys used mid-pipeline, proprietary RAG-retrieved documents, or business logic embedded in prompts. The same flaw lets them inject fabricated messages into that history, which could later mislead the workflow owner, corrupt an audit trail used for compliance, or — if the history is fed back as context to an LLM/agent — subtly poison that agent's future outputs.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-639Authorization Bypass Through User-Controlled KeyCWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- [Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- [Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow