5.9
Moyenne
CVE-2026-10547 IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST…
Description
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Langflow OSS 1.0 | 1.0.0 → 1.10.3 | Pas de correctif indiqué |
Autres CVE de Langflow OSS
Les 176 CVE de Langflow OSS →
CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code…
6.5
Moyenne
CVE-2026-77817
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to…
6.5
Moyenne
CVE-2026-77819
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…
6.5
Moyenne
CVE-2026-90991
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…
6.5
Moyenne