CVE-2026-9130: Langflow authz bypass leaks cross-user

CISO Take

IBM's Langflow OSS framework contains an authorization flaw in its MemoryComponent: chat history lookups filter only on session_id, without verifying that the requesting user actually owns that flow or session, so any authenticated user in a multi-user deployment can pull another user's stored conversation history by supplying or guessing their session_id. This matters wherever Langflow runs as a shared, multi-tenant flow-building platform (LANGFLOW_AUTO_LOGIN=False) — chat memory can carry prompts, retrieved documents, or other sensitive business context, and the CVSS 7.1 rating (network vector, low complexity, low privileges, no user interaction) reflects how easily this is triggered through the same authenticated API endpoints legitimate users already call. There's no public exploit or Nuclei scanner template yet, exploitation probability is low (EPSS 0.00175, though it ranks in the top 93rd percentile of scored CVEs), and it isn't in CISA KEV, so CISA's SSVC decision of TRACK is appropriate — this is a monitor-and-patch item, not an active-incident emergency. Teams running Langflow with multiple authenticated users should upgrade past 1.10.3 once IBM ships a fix, audit access logs on /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/* for cross-user session_id access patterns, and until patched, isolate tenants or restrict multi-user mode where feasible.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

Moderate-high risk in scope, low risk in likelihood. The flaw is trivially triggerable technically (AV:N/AC:L/UI:N) and needs only a low-privilege authenticated account (PR:L), so any onboarded user in a shared Langflow instance is a potential attacker — no social engineering or advanced tooling required. However, the blast radius is bounded: it only affects multi-user deployments running with LANGFLOW_AUTO_LOGIN=False (single-user/dev instances are unaffected), impact is confidentiality-only (C:H/I:L/A:N — no integrity or availability loss), there's no public PoC or scanner coverage, and EPSS exploitation probability is near-zero (0.00175). CISA's SSVC TRACK decision and absence from KEV confirm this should be scheduled for patching, not treated as an active threat.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a valid, low-privilege authenticated account on a multi-user Langflow deployment running with LANGFLOW_AUTO_LOGIN=False.

AML.T0012

Exploitation

Attacker calls authenticated API endpoints (/api/v1/run/*, /api/v1/responses, /api/v2/workflow/*) supplying a guessed or obtained session_id belonging to another user.

AML.T0049

Unauthorized Data Access

MemoryComponent.retrieve_messages filters solely on session_id and fails to validate flow_id/user_id ownership, returning the victim's stored chat history to the attacker.

AML.T0036

Impact

Attacker gains disclosure of another user's conversation data, prompts, and any sensitive context embedded in that chat history.

AML.T0057

Initial Access

Attacker obtains or already holds a valid, low-privilege authenticated account on a multi-user Langflow deployment running with LANGFLOW_AUTO_LOGIN=False.

AML.T0012

Exploitation

Attacker calls authenticated API endpoints (/api/v1/run/*, /api/v1/responses, /api/v2/workflow/*) supplying a guessed or obtained session_id belonging to another user.

AML.T0049

Unauthorized Data Access

MemoryComponent.retrieve_messages filters solely on session_id and fails to validate flow_id/user_id ownership, returning the victim's stored chat history to the attacker.

AML.T0036

Impact

Attacker gains disclosure of another user's conversation data, prompts, and any sensitive context embedded in that chat history.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

Upgrade Langflow past 1.10.3 as soon as IBM publishes a fixed release addressing this advisory (track https://www.ibm.com/support/pages/node/7282647). Until patched: if operationally possible, avoid running with LANGFLOW_AUTO_LOGIN=False in environments with untrusted or mutually-distrusting users, or isolate tenants into separate Langflow instances/namespaces. Treat session_id as a sensitive credential — ensure it is generated with sufficient entropy and never exposed in shareable links, logs, or client-side storage. Add detection: monitor API access logs for a single account querying an unusually high number of distinct session_id values on /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*, which would indicate enumeration or probing.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Privacy Violation Framework Agent AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application AML.T0080.000 - Memory

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - Data for AI systems — access control and confidentiality

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-9130?

IBM's Langflow OSS framework contains an authorization flaw in its MemoryComponent: chat history lookups filter only on session_id, without verifying that the requesting user actually owns that flow or session, so any authenticated user in a multi-user deployment can pull another user's stored conversation history by supplying or guessing their session_id. This matters wherever Langflow runs as a shared, multi-tenant flow-building platform (LANGFLOW_AUTO_LOGIN=False) — chat memory can carry prompts, retrieved documents, or other sensitive business context, and the CVSS 7.1 rating (network vector, low complexity, low privileges, no user interaction) reflects how easily this is triggered through the same authenticated API endpoints legitimate users already call. There's no public exploit or Nuclei scanner template yet, exploitation probability is low (EPSS 0.00175, though it ranks in the top 93rd percentile of scored CVEs), and it isn't in CISA KEV, so CISA's SSVC decision of TRACK is appropriate — this is a monitor-and-patch item, not an active-incident emergency. Teams running Langflow with multiple authenticated users should upgrade past 1.10.3 once IBM ships a fix, audit access logs on /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/* for cross-user session_id access patterns, and until patched, isolate tenants or restrict multi-user mode where feasible.

Is CVE-2026-9130 actively exploited?

No confirmed active exploitation of CVE-2026-9130 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9130?

Upgrade Langflow past 1.10.3 as soon as IBM publishes a fixed release addressing this advisory (track https://www.ibm.com/support/pages/node/7282647). Until patched: if operationally possible, avoid running with LANGFLOW_AUTO_LOGIN=False in environments with untrusted or mutually-distrusting users, or isolate tenants into separate Langflow instances/namespaces. Treat session_id as a sensitive credential — ensure it is generated with sufficient entropy and never exposed in shareable links, logs, or client-side storage. Add detection: monitor API access logs for a single account querying an unusually high number of distinct session_id values on /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*, which would indicate enumeration or probing.

What systems are affected by CVE-2026-9130?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, conversational memory / chat history stores, multi-tenant LLM orchestration platforms.

What is the CVSS score for CVE-2026-9130?

CVE-2026-9130 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworksconversational memory / chat history storesmulti-tenant LLM orchestration platforms

MITRE ATLAS Techniques

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

AML.T0080.000 Memory

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

Exploitation Scenario

An attacker with a valid, low-privilege account on a shared Langflow deployment (multi-user mode, AUTO_LOGIN disabled) either guesses a predictable session_id or obtains one incidentally (e.g., leaked in a shared link, log file, or support ticket). They then call an authenticated API endpoint such as /api/v1/run/{flow_id} or /api/v2/workflow/* supplying that session_id instead of their own. Because MemoryComponent.retrieve_messages validates only session_id and never checks that the caller owns the associated flow_id or user_id, the API returns the victim's stored conversation history — potentially including sensitive prompts, business data, or credentials the victim pasted into the chat — directly to the attacker with no alerting or additional authorization step.