CVE-2026-18904: Langflow namespace collision leaks

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a namespace collision between user identifiers that lets a remote, unauthenticated-adjacent attacker cross into another user's session — reading sensitive conversation and workflow data and injecting unauthorized messages into their active agent runs. This matters most for multi-tenant Langflow deployments where multiple builders or teams share an instance to design and run LLM agent flows: a CVSS 8.2 with no privileges and no user interaction required (AV:N/AC:L/PR:N/UI:N) means any authenticated user on a shared instance can potentially pivot into a peer's session. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so opportunistic mass exploitation is unlikely today — but IDOR-class bugs in AI agent platforms are trivial to weaponize once understood, and the injection primitive here can be chained into cross-user prompt injection against whatever LLM backs the victim's flow. Patch to the fixed Langflow release referenced in the IBM advisory immediately, and in the interim isolate multi-tenant Langflow instances (one instance per team/customer, or strict network segmentation) and audit access logs for anomalous cross-user session or message-ID access patterns.

Sources:NVDIBM Support advisory (ibm.com)ATLAS

What is the risk?

High risk for any shared or multi-tenant Langflow deployment. The vulnerability requires no privileges and no user interaction (PR:N/UI:N), has low attack complexity (AC:L), and is network-exploitable (AV:N) — the main constraint is that the attacker likely needs a valid (even low-privileged) account on the same Langflow instance to trigger the namespace collision, which caps it below a fully unauthenticated remote compromise. Confidentiality impact is high (C:H) — full exposure of another user's session data, potentially including embedded credentials, API keys, or proprietary flow logic — while integrity impact is limited (I:L) to injecting messages rather than arbitrary code execution or flow modification. No KEV listing, EPSS score, or public PoC exists yet, so exploitation-in-the-wild likelihood is currently unconfirmed, but IDOR/namespace-collision bugs are simple to discover via basic parameter manipulation once the target is identified, and this class of bug tends to age quickly into automated scanning.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a shared, multi-tenant Langflow instance.

AML.T0012

Exploitation

Attacker manipulates a user identifier to exploit the namespace collision (CWE-639) and access another user's session and message namespace.

Data Exposure

Attacker reads sensitive conversation data, flow configuration, or embedded credentials from the victim's session.

AML.T0057

Message Injection / Impact

Attacker injects unauthorized messages into the victim's active agent session, potentially redirecting the agent's downstream behavior.

AML.T0080.001

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a shared, multi-tenant Langflow instance.

AML.T0012

Exploitation

Attacker manipulates a user identifier to exploit the namespace collision (CWE-639) and access another user's session and message namespace.

Data Exposure

Attacker reads sensitive conversation data, flow configuration, or embedded credentials from the victim's session.

AML.T0057

Message Injection / Impact

Attacker injects unauthorized messages into the victim's active agent session, potentially redirecting the agent's downstream behavior.

AML.T0080.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed today18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

ILow

ANone

What should I do?

1 step

1) Patch: upgrade Langflow OSS to the version fixed after 1.11.1 per the IBM advisory (https://www.ibm.com/support/pages/node/7284579) as soon as it's validated in a staging environment. 2) Workaround: until patched, avoid multi-tenant Langflow deployments — provision separate instances per team/customer, or enforce network-level isolation (separate namespaces/VPCs) so user sessions cannot collide. 3) Detection: audit application logs for requests referencing session/message identifiers that don't belong to the authenticated user, repeated 403/404-then-success patterns on session endpoints, or unexpected message entries appearing in a user's chat history without a matching outbound request. 4) Rotate any credentials or API keys that were stored in Langflow flow variables on affected multi-tenant instances, since confidentiality impact is high. 5) Restrict Langflow instance access to a VPN or internal network while patching is in progress.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakagePrompt InjectionAgentFrameworkAML.T0057- LLM Data Leakage AML.T0080.001- Thread AML.T0092- Manipulate User LLM Chat History

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-AI system security

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluation

OWASP LLM Top 10

LLM02:2025-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-18904?

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a namespace collision between user identifiers that lets a remote, unauthenticated-adjacent attacker cross into another user's session — reading sensitive conversation and workflow data and injecting unauthorized messages into their active agent runs. This matters most for multi-tenant Langflow deployments where multiple builders or teams share an instance to design and run LLM agent flows: a CVSS 8.2 with no privileges and no user interaction required (AV:N/AC:L/PR:N/UI:N) means any authenticated user on a shared instance can potentially pivot into a peer's session. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so opportunistic mass exploitation is unlikely today — but IDOR-class bugs in AI agent platforms are trivial to weaponize once understood, and the injection primitive here can be chained into cross-user prompt injection against whatever LLM backs the victim's flow. Patch to the fixed Langflow release referenced in the IBM advisory immediately, and in the interim isolate multi-tenant Langflow instances (one instance per team/customer, or strict network segmentation) and audit access logs for anomalous cross-user session or message-ID access patterns.

Is CVE-2026-18904 actively exploited?

No confirmed active exploitation of CVE-2026-18904 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18904?

1) Patch: upgrade Langflow OSS to the version fixed after 1.11.1 per the IBM advisory (https://www.ibm.com/support/pages/node/7284579) as soon as it's validated in a staging environment. 2) Workaround: until patched, avoid multi-tenant Langflow deployments — provision separate instances per team/customer, or enforce network-level isolation (separate namespaces/VPCs) so user sessions cannot collide. 3) Detection: audit application logs for requests referencing session/message identifiers that don't belong to the authenticated user, repeated 403/404-then-success patterns on session endpoints, or unexpected message entries appearing in a user's chat history without a matching outbound request. 4) Rotate any credentials or API keys that were stored in Langflow flow variables on affected multi-tenant instances, since confidentiality impact is high. 5) Restrict Langflow instance access to a VPN or internal network while patching is in progress.

What systems are affected by CVE-2026-18904?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant SaaS AI deployments, conversational session management.

What is the CVSS score for CVE-2026-18904?

CVE-2026-18904 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant SaaS AI deploymentsconversational session management

MITRE ATLAS Techniques

AML.T0057LLM Data Leakage

AML.T0080.001Thread

AML.T0092Manipulate User LLM Chat History

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

Exploitation Scenario

An attacker with a low-privilege account on a shared/multi-tenant Langflow instance (e.g., a SaaS offering hosted Langflow to multiple internal teams or external customers) identifies that user session or message identifiers are generated in a way that can collide across accounts. By manipulating the identifier used in session/message API calls, the attacker accesses another user's active agent session, reading sensitive conversation data — potentially including embedded API keys or proprietary prompt/flow logic. The attacker then injects a crafted message into the victim's session, which the victim's agent processes as legitimate input, effectively achieving a cross-user prompt injection that can redirect the agent's tool calls or leak further data back to the attacker's own session.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.