CVE-2026-10560: IBM Langflow OSS Missing Authentication in Build Endpoints (CVSS 8.2)

Technical summary

The vulnerability exists in the /api/v1/build_public_tmp/ API endpoints, which fail to enforce authentication controls. An unauthenticated actor can submit requests with a known or guessed job identifier to retrieve build event logs or issue job cancellation commands. This absence of proper authentication (CWE-287) allows unauthorized information disclosure via the C confidentiality impact and limited unauthorized modification via the I integrity impact, as reflected in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Business impact

Organizations running Langflow OSS as part of data pipeline, machine learning workflow, or automation infrastructure face dual exposure: attackers can observe build logs that may contain credentials, API keys, model training details, or other sensitive configuration, and can disrupt active job execution causing workflow delays and operational downtime. For enterprises integrating Langflow into CI/CD or ETL processes, this could impact both confidentiality of proprietary logic and availability of critical data processing.

Affected systems

IBM Langflow OSS versions 1.0.0, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, 1.8.x, and 1.9.6 are affected. The vulnerability is specific to the open-source distribution; verify with IBM documentation whether proprietary or managed variants carry the same risk. Self-hosted deployments and containerized instances running these versions are in scope.

Exploitability

Exploitation requires only network access and knowledge of a valid job identifier—no authentication, no complex configuration, no user interaction. The attack surface is broad because job identifiers may be predictable, shared in logs, or discoverable through enumeration. An attacker can automate reconnaissance and job cancellation at scale. The CVSS score of 8.2 (HIGH) reflects the ease of exploitation and significant impact on confidentiality.

Remediation

Upgrade IBM Langflow OSS to a version that patches the /api/v1/build_public_tmp/ endpoints with mandatory authentication and authorization checks. Verify the specific patched version against IBM's official security advisory. As an interim control, restrict network access to the Langflow API using a Web Application Firewall (WAF) or API gateway to allow only authenticated requests, and rotate any credentials or tokens that may have been exposed through build logs.

Patch guidance

Contact IBM or monitor the official Langflow GitHub repository and security advisories for a patched release version that re-introduces authentication to the affected endpoints. Apply the patch immediately upon availability. Before patching, implement network-level controls to limit who can reach the /api/v1/build_public_tmp/ routes. Test the patch in a non-production environment to confirm build functionality is preserved and that authentication does not break legitimate workflows.

Detection guidance

Monitor API access logs for requests to /api/v1/build_public_tmp/ endpoints from unauthenticated sessions or unexpected sources. Alert on repeated attempts to cancel jobs or retrieve build event data with different job identifiers. Inspect build logs and event records for signs of unauthorized access, such as retrieval of logs from jobs not initiated by known users. Review recent job cancellations for anomalous patterns. If running Langflow in a containerized or cloud environment, enable API request logging and correlate with identity/access management systems to identify gaps.

Why prioritize this

Despite the absence of a CISA KEV entry, this vulnerability rates HIGH priority because it combines trivial exploitation (no authentication required, network-accessible) with meaningful impact on both confidentiality and availability. Organizations using Langflow for sensitive ML workflows, data processing, or integration with production systems should treat this as urgent. The broad version range (1.0.0–1.9.6) means many deployed instances are likely affected.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: (1) network attack vector with no special network access required (AV:N), (2) low attack complexity—standard HTTP requests suffice (AC:L), (3) no privileges needed (PR:N), (4) no user interaction required (UI:N), (5) unchanged scope (S:U), (6) high confidentiality impact via access to build logs and sensitive data (C:H), and (7) low integrity impact from the ability to cancel jobs, which is disruptive but not data modification (I:L, A:N). This is not a critical remote code execution, but the authentication bypass and ease of exploitation justify the HIGH severity rating.

Frequently asked questions