CVE-2026-19294: CWE-639 Authorization Bypass Through User-Controlled Key in IBM Langflow OSS

CVE-2026-19294 is an authorization bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.1. The flaw arises from improper authorization controls that allow a remote attacker with valid authentication to access and execute private flows belonging to other users by manipulating user-controlled keys. This vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and scope change.

An authenticated attacker can bypass authorization controls to access and execute private flows of other users, potentially leading to unauthorized disclosure and modification of sensitive data within the application. There is no impact on system availability. The vulnerability compromises confidentiality and integrity of user data.

No official patch or fix is currently documented. Patch status is not yet confirmed — check IBM's vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to private flow access.