Advisory · CVE-2026-97680
Improper access control in Langflow's flow result caching exposes data
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker read sensitive data or inject malicious data through improper access control in the vertex result caching subsystem. IBM rates it high at CVSS 8.3.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97680
CWE-284 - Action timing
- Immediate
Explain it like I’m five
Langflow keeps a pantry of half-finished recipe results so it can reuse them. The pantry door is supposed to open only for the cook who made each dish, but it opens for anyone in the kitchen, who can read or swap the dishes.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Cached results
The attacker requests cached vertex results that belong to other users' flow executions.
- 03Access check gap
Improper access control in the caching subsystem fails to stop the request.
- 04Read or tamper
The attacker reads sensitive results from other users' flows or injects malicious data into the cache that others will consume.
What happened
IBM disclosed CVE-2026-97680 on October 7, 2026: an improper access control flaw in the vertex result caching subsystem of IBM Langflow OSS versions 1.0.0 through 1.12.2. A remote authenticated attacker can obtain sensitive information from other users’ cached flow results or inject malicious data into the cache. IBM scores it high at CVSS 3.1 8.3, with confidentiality and integrity impacted.
Cached results on a shared instance can include model outputs, retrieved documents, and intermediate data from other users’ flows, so a read here crosses tenant boundaries. The injection side is subtler: poisoned cache entries can alter what other users’ flows produce, turning a data flaw into a downstream integrity problem for AI workloads.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment, including shared and multi-tenant instances, and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow and review who holds accounts on shared instances.
- Review application logs for cache access patterns from low-privilege accounts that do not match their own flows.
- On shared instances, review outputs generated during the vulnerable window for signs of tampering, and rotate any credentials that flows handled.
Management note
Cache poisoning on a shared AI platform corrupts trust in outputs, not just confidentiality. Upgrading closes the hole, but outputs produced while it was open should be treated as untrusted until reviewed.