Broken Access Control Vulnerabilities in IBM Langflow OSS API

CVE-2026-10700

What is CVE-2026-10700?

IBM Langflow OSS versions 1.0.0 to 1.8.4 exhibit multiple broken access control vulnerabilities within their file handling API. These flaws allow unauthorized access to user files through the API endpoints /api/v1/files/images/{flow_id}/{file_name} and /api/v1/files/download/{flow_id}/{file_name}. The first endpoint does not implement any authentication or authorization checks, posing a risk of exposing image files by merely supplying valid identifiers for flow_id and file_name. The second endpoint requires authentication but fails to adequately verify the ownership of the requested resources, allowing authenticated users to access files that belong to other users inadvertently. Such exploitation leads to unauthorized data disclosure and undermines tenant isolation in multi-user settings, potentially compromising sensitive information stored in private flows.

References