CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Attackers can access private AI workflows and execute vertices without proper ownership checks, leading to data disclosure and unauthorized code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-105698?
CVE-2026-105698 is a medium-severity missing authorization vulnerability in langflow-ai langflow, published on 5 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and receive their results. build_graph_from_db_no_cache performed a primary-key lookup without an owner filter. This could disclose private flow structure, configured values, and selected outputs and could trigger victim-configured side effects and build-history records, although it did not expose the victim's variable-store credentials or permit modification of the stored flow. This issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1.
Which versions are affected by CVE-2026-105698?
6 open source packages ship an affected version, including langflow and langflow-base.
| Package | Affected | Fixed in |
|---|---|---|
langflow PyPI | From 1.0.0 | 1.10.1 |
langflow PyPI | From 1.0.0 | 1.10.1 |
langflow PyPI | From 1.0.0 | 1.10.1 |
langflow-base PyPI | All versions | 0.10.1 |
langflow-base PyPI | All versions | 0.10.1 |
langflow-base PyPI | All versions | 0.10.1 |
How do I fix CVE-2026-105698?
Upgrade langflow to 1.10.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-105698 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105698 exists.
Sources
Also known as GHSA-gh98-4phw-6fmw, PYSEC-2026-4234, PYSEC-2026-4238.