Access Control Vulnerability in IBM Langflow OSS

CVE-2026-13444

What is CVE-2026-13444?

IBM Langflow OSS versions 1.0.0 through 1.10.1 are susceptible to an access control vulnerability that enables unauthorized users to access private vector documents. Attackers can exploit this weakness by creating their own workflow with identical Chroma persist_directory and collection_name parameters. As a result, they can obtain sensitive content from the victim's workflow output, even without proper authorization. Furthermore, attackers are capable of injecting their own documents into the victim's collection, compromising the integrity of shared data and leading to potential information breaches.

References