AI Threat AlertCVE-2026-19294: Langflow: authz flaw lets users run others' AI flows
MEDIUMIBM Langflow OSS versions 1.0.0 through 1.11.1 contain a broken authorization flaw that lets any authenticated user read and execute another user's private flow simply by referencing its identifier. On a shared or multi-tenant Langflow deployment this is a horizontal privilege escalation: a low-privilege account is enough, no user interaction is needed, and the CVSS vector confirms network-reachable, low-complexity exploitation (6.4, scope changed). There's no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks opportunistic rather than actively weaponized today — but Langflow flows routinely embed LLM API keys, vector database credentials, and proprietary prompt logic, so a successful IDOR here can turn into credential theft or unauthorized use of a colleague's AI integrations. Prioritize upgrading past 1.11.1 per IBM's advisory, and in the meantime audit who has accounts on any shared Langflow instance and rotate secrets stored inside flow definitions.
What is the risk?
Medium severity per CVSS (6.4) but the practical risk is elevated on any multi-tenant or team-shared Langflow deployment, since the bar to exploit is low (any authenticated low-privilege user, no interaction, low complexity, network-reachable) even though confidentiality and integrity impact are individually rated low. No EPSS percentile, KEV listing, or public PoC/Nuclei template exists yet, so mass exploitation is unlikely in the short term — this is more of a targeted insider-risk or SaaS multi-tenancy concern than an internet-scanning threat. The scope-changed CVSS vector reflects that a compromised low-priv account can affect resources (other users' flows) outside its own authorization boundary, which is the core concern for organizations running Langflow as a shared internal AI-building platform.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade Langflow to the version specified in IBM's advisory (patched release beyond 1.11.1) as soon as it's available and validated. Until patched, treat any shared/multi-tenant Langflow instance as high-risk: restrict account provisioning to trusted users only, review and tighten any reverse-proxy or network-level access controls around the instance, and audit flow ownership/ACL logs for anomalous cross-user flow ID access patterns (sequential or out-of-scope flow ID requests in API/access logs). Rotate any credentials (LLM API keys, vector DB connection strings) embedded in flows as a precaution, and consider isolating each tenant/team into its own Langflow instance rather than relying on in-app authorization boundaries until the fix is verified.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-19294?
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a broken authorization flaw that lets any authenticated user read and execute another user's private flow simply by referencing its identifier. On a shared or multi-tenant Langflow deployment this is a horizontal privilege escalation: a low-privilege account is enough, no user interaction is needed, and the CVSS vector confirms network-reachable, low-complexity exploitation (6.4, scope changed). There's no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks opportunistic rather than actively weaponized today — but Langflow flows routinely embed LLM API keys, vector database credentials, and proprietary prompt logic, so a successful IDOR here can turn into credential theft or unauthorized use of a colleague's AI integrations. Prioritize upgrading past 1.11.1 per IBM's advisory, and in the meantime audit who has accounts on any shared Langflow instance and rotate secrets stored inside flow definitions.
Is CVE-2026-19294 actively exploited?
No confirmed active exploitation of CVE-2026-19294 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-19294?
Upgrade Langflow to the version specified in IBM's advisory (patched release beyond 1.11.1) as soon as it's available and validated. Until patched, treat any shared/multi-tenant Langflow instance as high-risk: restrict account provisioning to trusted users only, review and tighten any reverse-proxy or network-level access controls around the instance, and audit flow ownership/ACL logs for anomalous cross-user flow ID access patterns (sequential or out-of-scope flow ID requests in API/access logs). Rotate any credentials (LLM API keys, vector DB connection strings) embedded in flows as a precaution, and consider isolating each tenant/team into its own Langflow instance rather than relying on in-app authorization boundaries until the fix is verified.
What systems are affected by CVE-2026-19294?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, multi-tenant AI platforms.
What is the CVSS score for CVE-2026-19294?
CVE-2026-19294 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0007Discover AI ArtifactsAML.T0012Valid AccountsAML.T0053AI Agent Tool InvocationAML.T0084Discover AI Agent ConfigurationCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.
Exploitation Scenario
An attacker with a low-privilege authenticated account on a shared Langflow instance — for example, a contractor or junior team member with basic access — enumerates or guesses flow object identifiers via the API/UI and successfully retrieves a flow definition belonging to a more privileged colleague. The exposed flow reveals an embedded API key for a paid LLM provider and a connection string to the team's production vector database. The attacker then triggers execution of that flow, consuming the victim's LLM API quota and querying the connected vector store to exfiltrate proprietary RAG-indexed documents, all while the activity appears to originate from the victim's configured integration.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-639Authorization Bypass Through User-Controlled KeyCWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- [Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- [Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow