Tools AI Risk Radar ai-incident-0143
Incident record
Langflow fixes access to other users’ flows
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- langflow, langflow-base
- Actor
- researcher
- CVE
- CVE-2026-105698
What happened
An authenticated user who knew another flow’s identifier could use older API routes to read its graph and execute individual components. The server failed to check ownership before returning the results.
langflow: affected >= 1.0.0, < 1.10.1; fixed in 1.10.1. langflow-base: affected < 0.10.1; fixed in 0.10.1. The date shown is the maintainer’s original disclosure date. Its advisory assigns 5.4 under CVSS 3.1.
Sources
- Primary disclosuregithub.com/langflow-ai/langflow/security/advisories/GHSA-gh9…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026