CVE-2026-9130

Katalog CVE

CVSS 7.1 · High EPSS 0,30%

Kerentanan Authorization Bypass Through User-Controlled Key pada langflow. Skor CVSS 3.1 7.1 (High) menurut us.ibm.com.

Deskripsi (NVD)

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber us.ibm.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.ibm.com/support/pages/node/7282647 advisory vendor