CVE-2026-17627: CWE-639 Authorization Bypass Through User-Controlled Key in IBM Langflow OSS

CVE-2026-17627 is an authorization bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.2. It allows a remote attacker who is authenticated with low privileges to bypass authorization controls due to improper handling of user-controlled keys. This flaw enables the attacker to obtain sensitive information and inject messages into the workflow history, potentially compromising data integrity and confidentiality. The vulnerability is tracked under CWE-639 and has a CVSS 3.1 base score of 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with low-level authentication can bypass authorization controls to access sensitive information and modify workflow history by injecting messages. This impacts confidentiality and integrity but does not affect availability. The scope is changed (S:C) indicating that the vulnerability affects resources beyond the attacker’s initial privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and monitor for suspicious activity related to workflow history modifications. Avoid granting unnecessary privileges to reduce risk.