CVE-2026-9225: 
Homebrew vulnerability analysis and mitigation

CVE-2026-9225 is an authorization bypass vulnerability in IBM Langflow OSS affecting versions 1.0.0 through 1.11.5. The flaw resides in the File/Read File component and allows authenticated attackers to access files belonging to other users by supplying crafted storage paths during flow execution. It was published on September 10, 2026, with a patch available as of the same date. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, IBM Support).

The root cause is an improper access control flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). When flows are executed via the /api/v1/run/advanced/{flow_id} API endpoint, the application accepts component inputs that reference file storage paths using arbitrary user or flow identifiers without verifying that the requesting user owns the referenced namespace. A low-privileged authenticated attacker can craft a file path pointing to another user's storage namespace, causing the backend to read and return that user's file contents, effectively bypassing the authorization checks enforced by the file management API (GitHub Advisory, IBM Support).

Successful exploitation results in unauthorized disclosure of sensitive files uploaded by other users, with a high confidentiality impact and no integrity or availability impact. Any authenticated user on the network can read files from arbitrary storage namespaces without possessing elevated privileges, potentially exposing confidential data such as documents, datasets, or credentials stored within the platform. The vulnerability does not enable code execution or data modification, but the cross-user data exposure could facilitate further attacks if sensitive credentials or configuration files are accessible (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time, as confirmed by NVD SSVC assessment indicating exploitation status of "none" (GitHub Advisory). The EPSS score is approximately 0.229% (14th percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authentication: Obtain a low-privileged account on the target IBM Langflow OSS instance (versions 1.0.0–1.11.5).
2. Identify a target flow: Enumerate available flows or use a known flow_id to construct a valid API request to the /api/v1/run/advanced/{flow_id} endpoint.
3. Craft malicious file path: In the flow execution request body, supply a File/Read File component input that references a storage path belonging to another user's namespace (e.g., substituting a different user ID or flow ID in the path).
4. Submit the request: Send the crafted POST request to /api/v1/run/advanced/{flow_id} with the manipulated file path as a component input parameter.
5. Retrieve file contents: The backend reads the targeted file without verifying ownership and returns its contents in the API response, exposing the victim user's data to the attacker (GitHub Advisory).

• Network: Repeated or anomalous POST requests to /api/v1/run/advanced/{flow_id} from a single authenticated user, especially with varying user or flow identifiers in file path parameters.
• Logs: API access logs showing a single user account accessing file paths associated with multiple different user namespaces or flow IDs in rapid succession.
• Logs: HTTP 200 responses to /api/v1/run/advanced/ requests where the file path in the request body does not match the authenticated user's own namespace.
• Application Behavior: Unusual volume of file read operations originating from a single low-privileged account across multiple storage namespaces.

IBM has released a patch addressing this vulnerability; users should upgrade IBM Langflow OSS to version 1.11.6 or later (IBM Support, GitHub Advisory). As an interim workaround prior to patching, administrators should implement additional server-side access control validation to ensure authenticated users can only reference files within their own storage namespace. Additionally, restrict or monitor execution of flows with arbitrary file path inputs via the /api/v1/run/advanced/ endpoint, and audit logs for unauthorized cross-namespace file access attempts.