High priorityDisclosed

Advisory · CVE-2026-107366

IBM Langflow OSS message endpoints skip ownership checks, allowing deletion, prompt injection, and session hijack

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification, so any authenticated user can delete another user's messages, overwrite message content, or hijack a session. CVSS 3.1 8.3.

Advisory published October 20, 2026Independent summary
Vendor
IBM
Product
IBM Langflow OSS
Identifier / CWE
CVE-2026-107366
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow message doors never ask whether the conversation belongs to the caller, so any logged-in user can delete, rewrite, or take over someone else's messages and sessions.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session held

    An attacker holds any valid Langflow account.

  2. 02Foreign message or session named

    The attacker calls one of the three message endpoints naming another user's messages or session ID.

  3. 03Ownership check missing

    The endpoint performs no ownership verification (CWE-639).

  4. 04Messages abused

    The attacker can bulk-delete messages, overwrite content to inject malicious prompts, or hijack the session by reassigning its session ID.

What happened

IBM PSIRT disclosed CVE-2026-107366: IBM Langflow OSS contains three message endpoints that perform no ownership verification (CWE-639). Any authenticated user can bulk-delete another user’s messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID. The CVSS 3.1 score is 8.3, with low privileges required and no user interaction.

Per the vendor affected data in the NVD record, affected releases are 1.0.0 through 1.12.4. No fixed version is stated in the NVD record itself; IBM’s bulletin is the reference for the fix.

What to do

  1. Inventory IBM Langflow OSS deployments, including shared team and hosted instances, and note the version of each.
  2. Apply the fix for your release line from IBM security bulletin 7293016; the NVD record lists the affected ranges, so confirm your line against the bulletin rather than assuming a fixed version.
  3. Restrict access to trusted networks and named users while remediation is underway.
  4. Hunt for message deletions or edits by users who do not own the conversation, unexpected session ID changes, and prompts that users do not recognise as their own.
  5. Verify the deployed fix level after updating, not just that an update ran.

Management note

Shared Langflow instances hold prompts, flows, and the credentials and data sources wired into them. Cross-user message control is both an integrity and a prompt injection risk, so patch shared instances first and treat unexplained message changes as incidents.