CVE-2026-6542 is an authorization bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.8.4. The flaw allows a user with limited privileges to manipulate the flow_id parameter to read sensitive transaction logs and vertex build data of other users and to delete persisted vertex build data associated with other users' flows. The vulnerability is categorized under CWE-639, indicating improper authorization. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting confidentiality but not integrity or availability.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive transaction logs and vertex build data from other users, compromising confidentiality. Additionally, attackers can delete persisted vertex build data belonging to other users, potentially causing data loss. There is no indication of impact on system integrity or availability beyond data deletion. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from IBM. Users should monitor IBM advisories for updates regarding patches or official mitigations. Until a fix is released, restricting access to trusted users and minimizing exposure of the affected versions may reduce risk.