CVE-2026-13444: 
Homebrew vulnerability analysis and mitigation

CVE-2026-13444 is an improper access control vulnerability in IBM Langflow OSS that allows authenticated attackers to access other users' private vector documents by crafting flows with matching Chroma persist_directory and collection_name values. It affects IBM Langflow OSS versions 1.0.0 through 1.10.1, with version 1.10.2 containing the fix. The vulnerability was published on July 30, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, IBM Advisory).

The root cause is a missing authorization boundary in how IBM Langflow OSS manages Chroma vector store namespaces (classified under CWE-520, though the underlying behavior more closely resembles an insecure direct object reference or namespace collision). Langflow does not enforce user-scoped isolation for Chroma persist_directory and collection_name parameters, meaning any authenticated user can specify the same storage identifiers as another user's flow and gain full read access to that collection's contents. Additionally, the attacker can write (pollute) documents into the victim's collection by inserting their own data into the shared namespace, requiring only low privileges and no user interaction (GitHub Advisory, IBM Advisory).

Successful exploitation allows an authenticated attacker to read the exact contents of another user's private vector documents — which may include sensitive embedded data, proprietary documents, or confidential AI workflow inputs — without any authorization to access the victim's flow. Beyond data disclosure, the attacker can inject malicious documents into the victim's Chroma collection, corrupting the integrity of their AI workflows and potentially influencing downstream model outputs or retrieval-augmented generation (RAG) results. Availability is not directly impacted, but the combination of high confidentiality and integrity impact makes this a significant risk in multi-tenant Langflow deployments (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.212%, placing it in the 12th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a low-privilege authenticated account, making it accessible to any registered user on a shared Langflow instance, which lowers the practical barrier despite the absence of public exploits.

1. Reconnaissance: Identify a target IBM Langflow OSS instance (versions 1.0.0–1.10.1) running in a multi-user environment. Obtain or register a low-privilege user account on the platform.
2. Identify target collection: Determine the victim's Chroma persist_directory and collection_name values. These may be discoverable through shared documentation, naming conventions, or by observing default/predictable naming patterns used by the application.
3. Create a malicious flow: As the attacker, create a new Langflow workflow that includes a Chroma vector store component configured with the exact same persist_directory and collection_name as the victim's flow.
4. Execute the flow to read victim data: Run the attacker-controlled flow. Because Langflow does not enforce user-level namespace isolation, the Chroma component will return the victim's stored vector documents directly in the attacker's workflow output.
5. Pollute the victim's collection (optional): Using the same flow, insert attacker-controlled documents into the shared Chroma namespace, corrupting the victim's collection and potentially influencing their AI/RAG pipeline outputs (GitHub Advisory, IBM Advisory).

• Logs: Langflow application logs showing a user creating or executing flows with Chroma persist_directory and collection_name values that match those belonging to a different user's flows; repeated flow executions by a user against collections they do not own.
• Application Behavior: Unexpected documents appearing in a user's Chroma collection that were not inserted by that user; RAG or retrieval workflow outputs returning unfamiliar or anomalous content.
• Audit/Access Logs: Multiple distinct user accounts referencing identical Chroma storage paths (persist_directory) within a short time window, particularly if those paths are associated with a specific victim user's data.
• File System: Unexpected files or entries in Chroma persist_directory paths that do not correspond to the owning user's workflow activity, indicating cross-user writes.

IBM has released a patch; users should upgrade IBM Langflow OSS to version 1.10.2 or later, which addresses the namespace isolation issue (IBM Advisory). As a workaround prior to patching, administrators should implement strict access controls on Chroma persist_directory and collection_name values to prevent users from specifying arbitrary storage namespaces. Consider enforcing user-scoped or uniquely hashed storage namespaces (e.g., prefixing collection names with a user ID or UUID) for each user's vector collections to prevent namespace collisions. Restrict Langflow deployments to trusted, single-tenant environments until the patch is applied.