CVE-2026-18904

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an authorization flaw (CWE-639, user-controlled key bypass) caused by a namespace collision between user identifiers. A remote, unauthenticated attacker can exploit this over the network by supplying or manipulating user identifiers that collide across namespaces. Successful exploitation allows the attacker to obtain sensitive information belonging to other users and to inject unauthorized messages. All deployments of Langflow OSS in the 1.0.0–1.11.1 range are affected, particularly multi-user or multi-tenant instances reachable over a network. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Langflow OSS to a release newer than 1.11.1 as soon as a patched version is published, and monitor IBM/PSIRT advisories for the fixed release. Until patched, avoid exposing Langflow directly to the internet and place it behind authentication or a reverse proxy. Operators of multi-user or multi-tenant deployments should review logs for cross-user data access or unexpected injected messages in flows and chats.