### Summary
Before **Langflow 1.10.1**, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:
- `POST /api/v1/build/{flow_id}/vertices` (`retrieve_vertices_order`)
- `POST /api/v1/build/{flow_id}/vertices/{vertex_id}` (`build_vertex`)
Any authenticated user who knows (or obtains) another user's `flow_id` could load that user's private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response.
Both routes are declared with `deprecated=True, include_in_schema=False`, so they do not appear in the OpenAPI docs, but they remained registered on the router. The Langflow UI no longer calls them (it uses `POST /api/v1/build/{flow_id}/flow`), so they are only reachable by direct HTTP requests.
The issue is fixed in **Langflow 1.10.1** (`langflow-base` 0.10.1) by [#13153](https://github.com/langflow-ai/langflow/pull/13153).
### Details
In affected versions, both handlers go straight to the graph loader:
- `retrieve_vertices_order` (`src/backend/base/langflow/api/v1/chat.py`, lines 81-159 in 1.9.1) only required authentication via `dependencies=[Depends(get_current_active_user)]`. The user was never injected into the handler, and the flow was loaded with `build_graph_from_db(flow_id=flow_id, ...)`.
- `build_vertex` (`chat.py`, lines 320-491 in 1.9.1) receives `current_user`, but only uses it for variable resolution (`user_id=str(current_user.id)`). It is never used to scope the flow lookup. The graph is taken from the chat-service cache keyed by `flow_id`, or rebuilt with `build_graph_from_db` on a cache miss.
- `build_graph_from_db_no_cache` (`src/backend/base/langflow/api/utils/flow_utils.py`) does a bare primary-key lookup, `session.get(Flow, flow_id)`, with no owner filter.
The supported replacement, `POST /api/v1/build/{flow_id}/flow`, already restricted the lookup to the owner or a `PUBLIC` flow (added in #12305 for GHSA-qj98-rhf8-v93f). The deprecated siblings were not covered by that fix, nor by the `_read_flow` fix for GHSA-8c4j-f57c-35cf.
Additional side effects in affected versions:
- `retrieve_vertices_order` stores the graph in the chat-service cache under the victim's `flow_id` (`chat_service.set_cache(str(flow_id), graph)`). When the request includes a `data` body, the cached graph is attacker-supplied.
- `build_vertex` schedules `log_vertex_build` for the victim's `flow_id`, so attacker-triggered builds are recorded in the victim flow's vertex build history.
Note on older versions: up to and including **1.7.1**, these two routes had no authentication dependency at all. Authentication was added in 1.7.2 by #10977, but no ownership check was added. This advisory covers the missing ownership check, which is present in every release from 1.0.0 (when the routes were introduced) through 1.10.0.
### Attack scenario
1. The attacker authenticates as any valid user.
2. The attacker obtains a victim `flow_id` (shared URLs, exported flow files, logs, screenshots, etc.).
3. `POST /api/v1/build/{victim_flow_id}/vertices` returns **200 OK** with `{"ids": [...], "run_id": "...", "vertices_to_run": [...]}` listing the victim flow's vertex IDs (component type plus suffix, e.g. `ChatInput-abc12`).
4. The attacker calls `POST /api/v1/build/{victim_flow_id}/vertices/{vertex_id}` for a returned ID. The victim's graph is loaded and the vertex is built. Its results, outputs and artifacts are returned to the attacker.
### Impact
- **Confidentiality (Low):** Discloses the structure of private flows (vertex IDs and component types) and the outputs of vertices the attacker chooses to build. That includes values hardcoded in node configuration, such as prompt text or fixed inputs.
- Global variables and credentials in the variable store are **not** exposed, because variable resolution uses the caller's `user_id`.
- The victim's stored flow definition is not returned wholesale.
- **Integrity (Low):** The attacker can trigger execution of the victim's nodes, including any side effects baked into their configuration (fixed endpoints, webhooks, hardcoded API keys). Build records are written under the victim's `flow_id`. The attacker cannot modify the stored flow.
- **Availability:** None.
The attacker must be authenticated and must know the target flow UUID. Flow UUIDs are random v4 values, so blind enumeration is not practical.
### Proof of concept
Observed on `langflow==1.9.1` using the project's test client and in-memory SQLite fixtures (see the attached `poc.zip`):
| Request | Expected (hardened) | Observed on 1.9.1 |
|---|---|---|
| Attacker → `POST /api/v1/build/{victim_flow_id}/vertices` | `404 Not Found` | `200 OK` with vertex order payload |
| Attacker → `POST /api/v1/build/{victim_flow_id}/vertices/<bogus-id>` | `404 Not Found` | `500` `{"detail":"Vertex <id> not found"}`: the victim graph was loaded before the vertex lookup failed |
| Owner (
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.
CVE-2026-105697 is a critical OS command injection vulnerability in langflow-ai's langflow prior to version 1.10.3. It allows an authenticated user or, under default insecure configurations, an unauthenticated user to execute arbitrary OS commands on the host running langflow by configuring malicious MCP servers. The vulnerability arises from insufficient validation of commands and arguments passed to the MCP stdio transport, which executes them via a shell wrapper before version 1.10.3. This flaw was fully fixed in langflow 1.10.3 by enforcing strict command allowlisting and removing shell usage in command execution.
CVE-2026-71297 is a vulnerability in Red Hat Multicluster Engine for Kubernetes involving the maestro gRPC broker. It allows a remote attacker with a valid client certificate to bypass authentication. This bypass can lead to unauthorized subscription to other consumers' event streams and the ability to publish forged agent status, resulting in information disclosure and data integrity compromise.
CVE-2026-105767 is an OS command injection vulnerability in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu). It arises from improper neutralization of special elements in the project_id or storage_bucket inputs, which are directly interpolated into Bash gcloud storage cp commands. Although the vulnerability allows arbitrary shell command execution on the GitHub Actions runner if an attacker controls these inputs, the only known caller uses repository secrets and runs on trusted triggers, so untrusted input was not known to reach the vulnerable code. The CVSS 4.0 score is low (2.1).
CVE-2026-105766 is a low-severity vulnerability in Chainguard Academy (edu) caused by the use of the backend-facing $scheme variable in nginx.conf for trailing-slash directory redirects. This results in a 301 redirect from HTTPS to HTTP, exposing documentation content to on-path attackers who can read or modify it. The issue arises because TLS terminates at the load balancer, and the redirect sends clients to an unencrypted HTTP URL. Clients enforcing HSTS, such as browsers with the .dev domain preloaded, are not affected. However, clients that do not enforce HSTS, including some command-line HTTP clients and scripts, remain vulnerable.
CVE-2026-105392 is a vulnerability in Lybbn Django-Vue-Lyadmin up to version 3.2.12 where a hard-coded cryptographic key is used in the JWT signing component. This issue arises from the SECRET_KEY argument in backend/application/settings.py. Remote exploitation is possible, and the exploit has been publicly disclosed. The project maintainer advises developers to manually change the keys before deployment to mitigate the risk.
Ghost, a Node.js content management system, had a path traversal vulnerability in versions 6.14.0 through 6.26.0. This vulnerability allowed staff users to access local files outside the intended data storage directories due to an input validation issue. The issue was fixed in version 6.27.0. The vulnerability has a low severity score and requires staff-level privileges to exploit.
CVE-2026-105389 is a medium severity vulnerability in feelec-yishu feelcrm-os version 1.0.0. It involves an unrestricted file upload issue in the UploadTicketFile endpoint, specifically in the UploadController.class.php file. The vulnerability arises from improper handling of the 'cmd' argument, allowing remote attackers to upload files without restriction. The exploit has been publicly disclosed, but no official response or patch has been provided by the vendor yet.
A Server-Side Request Forgery (SSRF) vulnerability exists in the TryGhost Ghost content management system versions 1.18.0 through 6.26.0. This vulnerability affects the webhooks feature and allows staff users to make requests to internal hosts from the Ghost server. The issue is resolved in version 6.27.0.
A vulnerability in Ghost, a Node.js content management system, allowed unauthorized access to comments due to improper input validation. This issue affected versions from 5.9.0 up to but not including 6.44.1 and was fixed in version 6.44.1.
A missing authorization vulnerability in TryGhost Ghost allows users with the Author role to delete posts and pages they did not author. This issue affects Ghost versions from 5.81.0 up to but not including 6.60.0. The vulnerability has been fixed in version 6.60.0. The CVSS score is 6.5, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild.
A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost versions 6.22.1 through 6.64.0. The issue arises because the default local storage adapter does not enforce content type restrictions on uploaded files, allowing scripts to be hosted on the site's domain. This can lead to compromise of other staff users' admin sessions. The vulnerability is fixed in version 6.64.0.
A privilege management vulnerability in TryGhost Ghost allows staff users with Editor or Super Editor roles to assign their own role to Author and Contributor users, despite lacking permission to do so. This issue affects Ghost versions from 0.5.0 up to but not including 6.64.0. The vulnerability has a medium severity with a CVSS score of 4.3. Version 6.64.0 contains a fix that addresses this issue.
CVE-2026-94201 is a high-severity vulnerability in the ash-project's ash library affecting versions from 3.5.1 up to but not including 3.34.3. It arises from unsafe handling of :atom-typed attributes with the unsafe_to_atom? constraint set to true, leading to unbounded atom table growth when attacker-controlled filter values are used. This can exhaust the BEAM atom table and crash the node, causing a denial of service. The issue is fixed by adding a coercion method that avoids interning new atoms during filtering comparisons.
CVE-2026-105677 is a path traversal vulnerability in TryGhost Ghost that allows an authenticated Administrator to execute arbitrary code on the server via a crafted theme. The issue affects Ghost versions from 6.10.3 up to but not including 6.64.0. The vulnerability is fixed in version 6.64.0. This flaw arises from improper limitation of pathname to a restricted directory when loading theme translation files.
CVE-2026-49878 is a high-severity remote code execution vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. The flaw exists in the wpas_handle_robust_av_scs_recv_action function of robust_av.c, where a logic error can cause an out-of-bounds write. Exploitation does not require user interaction but does require system-level execution privileges.
CVE-2026-105676 is a path traversal vulnerability in TryGhost Ghost affecting versions from 1.20.0 up to but not including 6.64.0. It allows an authenticated Administrator to read JSON files outside the active theme's directory, potentially exposing sensitive server configuration secrets. The issue is fixed in version 6.64.0.
CVE-2026-105388 is a medium severity SQL injection vulnerability in feelcrm-os version 1.0.0. It affects the Member Endpoint component, specifically the index function in MemberController.class.php, allowing remote attackers to manipulate the group_id argument to execute SQL injection. The vulnerability has a publicly available exploit, and the vendor has not yet responded or issued a patch.
CVE-2026-104029 is a vulnerability in the SSSD component of Red Hat Enterprise Linux 10 where a local attacker can cause an out-of-bounds memory read by sending a specially crafted request to the autofs responder UNIX socket. This leads to a crash of the autofs responder process, resulting in a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 3.3, indicating low severity. No affected versions or patch information are explicitly provided in the input data.