CVE-2026-9130: 
Homebrew vulnerability analysis and mitigation

CVE-2026-9130 is an authorization bypass vulnerability in IBM Langflow OSS affecting versions 1.0.0 through 1.10.3. The flaw resides in the MemoryComponent and allows authenticated users to access chat history belonging to other users via session_id collision. It was published on August 5, 2026, with a patch available as of the same date. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) and is classified under CWE-639 (GitHub Advisory, IBM Advisory).

The root cause is an insecure direct object reference pattern (CWE-639: Authorization Bypass Through User-Controlled Key) in the MemoryComponent.retrieve_messages and store_message methods, which filter chat history records solely by session_id without validating flow_id or user_id ownership. An attacker who knows or can guess a valid session_id belonging to another user can supply it directly to multiple authenticated API endpoints — /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/* — to retrieve that user's conversation data. The vulnerability is only exploitable in multi-user deployments where LANGFLOW_AUTO_LOGIN=False, meaning single-user or auto-login configurations are not affected (GitHub Advisory, IBM Advisory).

Successful exploitation allows any authenticated user to read the full chat history of other users, resulting in a high confidentiality impact and a low integrity impact (no availability impact). Sensitive AI conversation data — which may include proprietary prompts, business logic, or personal information — can be disclosed across all users of a shared Langflow deployment. While lateral movement is not directly enabled, the exposed conversation data could reveal credentials, internal workflows, or other sensitive context that facilitates further attacks (GitHub Advisory, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.175% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid authentication credentials, reducing the attack surface compared to unauthenticated vulnerabilities, but the low attack complexity and absence of required user interaction make it straightforward for any authenticated attacker to attempt (GitHub Advisory).

1. Authenticate: Obtain valid credentials for any user account on a multi-user IBM Langflow OSS deployment running version 1.0.0–1.10.3 with LANGFLOW_AUTO_LOGIN=False.
2. Obtain or enumerate session IDs: Identify a target session_id belonging to another user. This may be achieved through application logs, shared infrastructure access, or by systematically enumerating predictable or sequential session identifiers.
3. Craft a malicious API request: Submit an authenticated HTTP request to one of the vulnerable endpoints (e.g., GET /api/v1/responses or POST /api/v2/workflow/*) supplying the target user's session_id as a query parameter or request body field.
4. Retrieve cross-user chat history: The MemoryComponent.retrieve_messages method returns chat history filtered only by session_id, without verifying flow_id or user_id ownership, so the response contains the target user's conversation data.
5. Exfiltrate data: Collect and analyze the returned chat history for sensitive information such as credentials, internal workflows, or proprietary AI prompts (GitHub Advisory, IBM Advisory).

• Network: Authenticated API requests to /api/v1/responses, /api/v1/run/*, or /api/v2/workflow/* endpoints where the session_id parameter does not match any session associated with the authenticated user's account.
• Logs: Application or access logs showing a single authenticated user account querying multiple distinct session_id values in rapid succession, particularly those belonging to other users.
• Logs: Repeated HTTP 200 responses to the above endpoints from a user account that has no corresponding flow or workflow ownership for the requested session_id.
• Application Behavior: Anomalous volume of chat history retrieval requests from a single user account, especially outside normal usage hours or patterns.

IBM has released a fix in Langflow OSS version 1.11.0, which adds proper validation of flow_id and user_id ownership in the MemoryComponent.retrieve_messages and store_message methods. Organizations running multi-user deployments with LANGFLOW_AUTO_LOGIN=False should prioritize upgrading to version 1.11.0 or later immediately. As a temporary workaround prior to patching, administrators may consider restricting access to the affected API endpoints (/api/v1/run/*, /api/v1/responses, /api/v2/workflow/*) at the network or API gateway level, or reverting to single-user mode if operationally feasible (IBM Advisory, GitHub Advisory).

IBM published an official security bulletin acknowledging the vulnerability and providing remediation guidance (IBM Advisory). The vulnerability was also catalogued by INCIBE-CERT and tracked by multiple CVE aggregation platforms shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE tracking activity.