IBM Langflow OSS Authorization Bypass Vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a critical authorization vulnerability within three message endpoints. The root cause is a failure to implement ownership verification during message processing requests. An authenticated user can exploit these endpoints to perform operations on messages and sessions belonging to other users. This vulnerability allows for unauthorized bulk deletion of message history, the modification of message content to facilitate prompt injection attacks, and the hijacking of active conversation sessions through session ID reassignment. Because this flaw exists in the application API, it impacts the integrity of user data and the confidentiality of ongoing workflows within the Langflow environment. Defenders should focus on monitoring for anomalous API requests targeting message management endpoints.

Impact

Successful exploitation results in unauthorized modification or deletion of communication records and full takeover of conversation sessions. This impacts any enterprise sector utilizing Langflow for LLM workflow orchestration, potentially leading to the leakage of sensitive internal prompts or the manipulation of AI-driven decision-making processes.

Recommendation

• Upgrade IBM Langflow OSS to a version beyond 1.12.4 as soon as the vendor provides a patch.
• Audit API access logs for high-frequency or bulk requests to message endpoints that do not correspond to the authenticated user's standard activity patterns.
• Implement strict network-level access controls for the Langflow management API to limit the exposure of the vulnerable endpoints to authorized administrative subnets only.