CVE-2026-105698: CWE-639: Authorization Bypass Through User-Controlled Key in langflow-ai langflow

Langflow versions 1.0.0 through 1.10.0 have an authorization bypass vulnerability (CWE-639) in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} endpoints. Up to version 1.7.1, unauthenticated users knowing another user's flow UUID could access these handlers. From 1.7.2 to 1.10.0, authentication was required but no elevated privileges were needed. This allowed attackers to retrieve and cache private graph data, enumerate vertex identifiers, execute selected vertices, and receive their results. The primary-key lookup lacked an owner filter, exposing private flow structure and outputs, and potentially triggering victim-configured side effects and build-history records. The vulnerability does not expose variable-store credentials or allow flow modification. The issue is resolved in Langflow 1.10.1 and langflow-base 0.10.1.

An attacker with knowledge of another user's flow UUID could access private flow data and outputs without proper authorization, potentially triggering side effects configured by the victim and generating build-history records. However, the attacker cannot modify the stored flow or access sensitive variable-store credentials. This could lead to information disclosure and unintended execution of flow vertices.

A fixed version is available: upgrade Langflow to version 1.10.1 and langflow-base to version 0.10.1 to remediate this authorization bypass vulnerability. No other mitigation is required as the issue is resolved in these versions.