Security Advisory

CVE-2026-9130

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-05 18:16:05

Last updated 2026-08-05 19:42:47

Assigner ibm

CVSS score not scored

State PUBLISHED

Description

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

← Browse all CVEs View on cve.org ↗