Listen to this Post
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to an authorization bypass vulnerability that stems from improper isolation of per‑user vector store namespaces. Langflow is a visual framework for building AI‑powered agentic workflows, and it relies on vector databases (Chroma by default) to store and retrieve document embeddings for Retrieval‑Augmented Generation (RAG) pipelines. Each flow can be configured with a knowledge base that points to a vector collection, defined by two parameters: `persist_directory` (the on‑disk location where the vector index is stored) and `collection_name` (the logical name of the collection within that store).
The vulnerability arises because these parameters are user‑supplied and are not scoped or validated against the authenticated user’s ownership. An attacker with valid credentials to the Langflow instance can create their own flow and arbitrarily set the `persist_directory` and `collection_name` to exactly match those used by any other user’s private flow. Because Chroma (and other backends like FAISS) does not enforce per‑user access controls at the storage layer, the attacker’s flow will directly read from the victim’s vector index.
Once the attacker executes their flow, the Langflow workflow engine retrieves documents from the shared namespace and returns the victim’s exact vector document content in the attacker’s workflow output. This occurs without any authorization check to verify whether the attacker has permission to access the victim’s flow or its underlying data. The attacker does not need to know the victim’s flow ID or any other metadata—only the `persist_directory` and `collection_name` values, which can often be guessed or discovered through information disclosure.
Beyond unauthorized reading, the vulnerability also enables data pollution. The attacker can insert their own documents into the same shared collection, thereby corrupting the victim’s knowledge base with malicious or misleading content. This can degrade the quality of the victim’s RAG outputs, poison downstream decision‑making, or serve as a vector for further social engineering attacks.
The root cause is the absence of user‑scoped namespacing in the persistent vector store layer. Langflow does not prefix or transform the user‑supplied `persist_directory` and `collection_name` with a unique user identifier, nor does it maintain an ownership mapping that can be enforced at query time. As a result, any authenticated user can navigate to any other user’s vector namespace simply by replicating the configuration values. The attack requires no special privileges beyond a valid login, and it can be carried out entirely through the Langflow UI or via direct API calls to the flow creation and execution endpoints.
IBM has assigned CWE-520 (.NET Misconfiguration: Use of Impersonation) to this issue, though the vulnerability is more accurately described as a missing authorization check in a shared resource namespace. The CVSS 3.1 base score provided by CISA‑ADP is 8.1 (HIGH) , with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting the network accessibility, low attack complexity, low privileges required, and the significant confidentiality and integrity impact.
DailyCVE Form
Platform: IBM Langflow OSS
Version: 1.0.0 – 1.10.1
Vulnerability: Authorization Bypass (Vector Namespace)
Severity: HIGH (CVSS 8.1)
Date: 2026‑07‑30
Prediction: 2026‑08‑14
What Undercode Say
The following analytics and commands can be used to detect and reproduce the vulnerable behavior.
Check current Langflow version:
pip show langflow | grep Version
List all flows and inspect vector configuration (requires access to Langflow database or API):
Query the flows table for persist_directory and collection_name sqlite3 ~/.langflow/langflow.db "SELECT id, name, data FROM flow WHERE data LIKE '%persist_directory%';"
Simulate an attacker flow creation via API (using curl):
curl -X POST https://langflow-instance/api/v1/flows \
-H "Authorization: Bearer $ATTACKER_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "attacker_flow",
"description": "Access victim vector store",
"data": {
"nodes": [
{
"id": "vector-store-node",
"type": "VectorStore",
"data": {
"persist_directory": "/path/to/victim/vector/store",
"collection_name": "victim_collection"
}
}
]
}
}'
Execute the attacker flow to retrieve victim documents:
curl -X POST https://langflow-instance/api/v1/run/attacker_flow \
-H "Authorization: Bearer $ATTACKER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"input_value": "retrieve all documents"}'
Monitor for unauthorized namespace access in logs:
grep -E "persist_directory|collection_name" /var/log/langflow/.log | grep -v "user_id=$CURRENT_USER"
Exploit
An authenticated attacker can exploit this vulnerability in two primary ways:
1. Unauthorized Document Retrieval – By creating a new flow and setting `persist_directory` and `collection_name` to match a victim’s flow, the attacker’s workflow will fetch and output the exact documents stored in the victim’s vector collection. This exposes sensitive data that may include proprietary business documents, personal information, or internal communications that were ingested into the victim’s knowledge base.
2. Data Pollution (Poisoning) – The attacker can also insert new documents into the shared collection using the same vector store node. This can be done by configuring a flow that writes to the victim’s `persist_directory` and collection_name. Once inserted, the victim’s future RAG queries will return the attacker’s injected content alongside legitimate documents, potentially altering the victim’s workflow outputs, injecting false information, or triggering unintended actions in downstream automation.
The attack requires no brute‑forcing or privilege escalation. The attacker only needs to know or guess the victim’s vector store configuration. These values are often predictable (e.g., using default paths like `./chroma_data` or collection names based on flow names) or can be enumerated through other information disclosure vulnerabilities present in the same Langflow version.
Protection
- Upgrade to Langflow OSS version 1.10.2 or later – IBM has released a patched version that introduces per‑user namespacing for vector stores. In the fixed release, each user’s `persist_directory` and `collection_name` are automatically prefixed with a unique user identifier, preventing cross‑user namespace collisions. This is the only complete remediation.
- If upgrading is not immediately possible, restrict access to the Langflow instance – Deploy the application behind a VPN or an authenticated reverse proxy (e.g., using OAuth2 Proxy or Cloudflare Access) to limit who can authenticate to the platform. Since the vulnerability requires a valid login, reducing the attacker pool reduces risk.
- Monitor and audit vector store directories – Regularly inspect the on‑disk vector storage locations (e.g.,
./chroma_data,./faiss_index) for unexpected collections or files that do not correspond to known flows. Implement file integrity monitoring (FIM) on these directories to detect unauthorized writes. - Apply network‑level segmentation – Isolate the Langflow service and its vector database backend (e.g., Chroma server) from untrusted networks. Ensure that only the Langflow application process can access the vector store files, and that direct external access to the vector store is blocked.
- Implement custom authorization middleware – As a temporary workaround, deploy a custom API gateway or middleware that intercepts flow creation and execution requests, validates that the requesting user owns the specified `persist_directory` and
collection_name, and rejects unauthorized access. This can be done using a sidecar proxy (e.g., Envoy) with an external authorization filter.
Impact
- Confidentiality Breach (High) – An attacker can read any vector document belonging to any other user. This includes all documents ingested into a victim’s knowledge base, which may contain trade secrets, personally identifiable information (PII), financial data, or other sensitive content. The attacker receives the exact document text in their workflow output, making exfiltration trivial.
- Data Integrity Compromise (High) – By inserting malicious or misleading documents into a victim’s collection, the attacker can poison the victim’s RAG pipeline. This can cause the victim’s AI agents to return incorrect answers, make faulty decisions, or inadvertently propagate the attacker’s content to downstream systems or end‑users.
- Reputational and Operational Damage – Organizations using Langflow for customer‑facing AI assistants or internal decision support may suffer from degraded service quality, loss of customer trust, and potential regulatory penalties if sensitive data is exposed. The pollution aspect can also lead to costly incident response and data‑cleanup efforts.
- Lateral Movement Enabler – Exposed documents may contain credentials, API keys, or internal system details that an attacker can leverage to pivot to other systems or escalate privileges within the organization’s infrastructure.
- CVSS Score 8.1 (HIGH) – The vulnerability is network‑exploitable, requires low attack complexity, and has significant confidentiality and integrity impacts. It does not require user interaction and can be executed by any authenticated user, making it a high‑priority remediation target.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
