IBM Langflow OSS CVE-2026-107366: Authenticated Users Can Hijack Sessions

IBM Langflow OSS contains a high-severity vulnerability that permits authenticated users to manipulate data belonging to other users. The flaw exists in three message endpoints that fail to verify ownership of the data being accessed.

What happened

The National Vulnerability Database records CVE-2026-107366 as a high-severity issue with a CVSS score of 8.3. The vulnerability is classified under CWE-639, which relates to authorisation issues. It affects IBM Langflow OSS versions ranging from 1.0.0 up to and including 1.12.4.

The core issue is that specific message endpoints do not perform ownership verification. Consequently, any user who has successfully authenticated to the system can interact with data they do not own. This includes the ability to bulk-delete messages created by other users.

Furthermore, an attacker can overwrite existing message content. This capability allows for the injection of malicious prompts into conversations. The flaw also enables session hijacking through the reassignment of session IDs, effectively allowing one user to take over another's active conversation.

Why it matters

This vulnerability breaks the fundamental isolation between users in a multi-tenant or shared environment. Without ownership checks, the application cannot distinguish between legitimate actions and malicious interference.

For security operations teams, this means that internal threats or compromised accounts pose a significant risk. An attacker does not need administrative privileges to cause damage; standard authentication is sufficient.

The ability to inject malicious prompts is particularly concerning for AI-driven workflows. It could lead to prompt injection attacks that alter the behaviour of downstream models or extract sensitive information from other users' sessions.

Next steps

• Inventory all instances of IBM Langflow OSS to identify versions between 1.0.0 and 1.12.4.
• Verify if any production environments expose these message endpoints to multiple users.
• Monitor for unusual deletion or modification patterns in message logs.
• Plan for an upgrade once a patched version is confirmed by the vendor.

Detection notes

Teams usually detect this type of activity by monitoring for anomalous user behaviour in application logs. Look for instances where a single user ID is associated with mass deletions or content changes across multiple distinct sessions. Check whether message timestamps align with the user's typical activity patterns. If a user suddenly modifies conversations that are not theirs, this is a strong indicator of abuse. Containment moves should include isolating the affected endpoints and reviewing access logs to identify the scope of the compromise.

What to do and how to stay safe: IBM

• Audit current IBM Langflow OSS installations to confirm if they fall within the vulnerable version range.
• Implement strict logging on message endpoints to track who is accessing or modifying which sessions.
• Review authentication logs for signs of compromised credentials that could facilitate this abuse.
• Wait for the vendor to release a confirmed fix before applying any unofficial patches.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of IBM Langflow OSS are affected?

Versions 1.0.0 through 1.12.4 are affected by this vulnerability.

What is the CVSS score for CVE-2026-107366?

The CVSS score is 8.3, which is rated as high severity.

Can unauthenticated users exploit this flaw?

No, the vulnerability requires an authenticated user to perform the actions.