CVE-2026-6542 is an authorization bypass vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.8.4) where the application fails to properly restrict access to flow-related data. Specifically, any user can supply a flow_id to read transaction logs and vertex build data of other users and delete persisted vertex build data associated with another user's flow. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

Exploitation of this vulnerability allows an attacker with limited privileges to access sensitive transaction logs and vertex build data belonging to other users, potentially exposing confidential information. Additionally, attackers can delete persisted vertex build data for other users, leading to data loss. There is no impact on integrity or availability beyond the deletion capability. No known exploits are reported in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to IBM Langflow OSS instances to trusted users only and monitor for suspicious activity related to flow_id parameters. Avoid exposing the service to untrusted networks or users.