CVE-2026-105698

Executive Summary

CVE-2026-105698 is an authorization bypass (CWE-639) in Langflow, an open-source platform for building and deploying AI-powered agents and workflows. From version 1.0.0 until 1.10.1, the deprecated flow vertex handlers failed to verify flow ownership, allowing a caller who knew a victim's flow UUID to load, enumerate, and selectively execute vertices belonging to another user's private flow. The impact is limited confidentiality and integrity exposure (CVSS 5.4) — private flow structure, configured values, and selected outputs can be disclosed and victim-configured side effects can be triggered — but the flaw does not expose variable-store credentials or permit modification of the stored flow.

Technical Analysis

Langflow exposes build handlers under the API path POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id}. These handlers are described as deprecated, but remained reachable across the affected version range and were not protected by a flow-ownership check.

The vulnerability arises from two compounding defects:

1. Missing ownership authorization (CWE-639). Neither handler enforced a check that the authenticated (or, in older versions, unauthenticated) caller owned the flow identified by {flow_id}. Authorization is effectively keyed on knowledge of the flow UUID rather than on a verified subject-to-resource relationship.

2. Primary-key lookup without owner filter. The routine build_graph_from_db_no_cache performed a primary-key lookup of the flow without an owner filter. Because the lookup is keyed solely on the flow identifier, any caller who can reach the handler with a valid flow UUID obtains the graph regardless of tenancy boundaries.

The attack surface behavior differs by version:

• 1.0.0 through 1.7.1: The handlers were reachable by an unauthenticated caller who knew another user's flow UUID.
• 1.7.2 through 1.10.0: The handlers required authentication, but no elevated privileges — any authenticated user could reach them.

Once reached, the abuse chain uses two internal routines described in the advisory. retrieve_vertices_order loads and caches the private graph and enumerates its vertex identifiers. build_vertex then executes selected vertices and returns their results to the caller. Because vertex execution is driven by victim-authored configuration, the caller can cause the victim's configured side effects to run and can create build-history records — a limited integrity impact — while receiving the outputs of those vertices.

The advisory is explicit about the boundaries of exposure: the flaw did not expose the victim's variable-store credentials and did not permit modification of the stored flow. This is a read/execute primitive against the victim's graph model, not a credential-theft or persistence primitive.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the behavior described in the NVD record.

1. Reconnaissance / target identification. The attacker identifies a reachable Langflow deployment (default web UI historically presented on port 7860) and determines that the build endpoints are exposed. On versions 1.0.0–1.7.1 this requires no account; on 1.7.2–1.10.0 the attacker needs any valid low-privilege account. The critical prerequisite is obtaining or guessing another user's flow UUID. Because the handler does no ownership filtering, the UUID itself is the authorization token. UUIDs are commonly leaked via shared links, screenshots, logs, exports, browser history, collaboration tooling, or lower-severity information disclosure issues.

2. Triggering the flaw class. The attacker issues a request to POST /api/v1/build/{flow_id}/vertices, substituting the victim's flow UUID for {flow_id}. Because neither the ownership check nor the owner filter in build_graph_from_db_no_cache is applied, the server performs a primary-key lookup and returns the graph. No privilege escalation step is required — the missing check is the entire bypass.

3. Payload / execution method (class level). The attacker uses the vertex listing to obtain vertex identifiers, then calls POST /api/v1/build/{flow_id}/vertices/{vertex_id} for selected vertices. retrieve_vertices_order caches the private graph so vertices can be addressed, and build_vertex executes the chosen vertex and returns the result. At the class level, this is a direct object reference combined with arbitrary tenant-configured code/component execution as configured by the victim, not attacker-supplied code injection. The attacker selects which of the victim's own configured vertices to run.

4. Post-exploitation impact. Outcomes are bounded by the advisory's stated scope: disclosure of private flow structure, configured values, and selected vertex outputs; and triggering of victim-configured side effects plus generation of build-history records. The attacker does not obtain variable-store credentials and cannot modify the stored flow. Practically, the disclosed graph and outputs may contain embedded API keys or secrets configured inside individual components (a data-exposure concern that follows from reading configured values), and the triggered side effects may consume victim quotas, incur external API costs, or cause unintended actions in downstream integrations the victim wired into the flow.

Impact Assessment

CVSS 3.1 base score 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

• AV:N — reachable over the network via the Langflow HTTP API.
• AC:L — no special conditions beyond knowledge of a valid flow UUID (and, in 1.7.2+, a valid account).
• PR:L — the score reflects the 1.7.2–1.10.0 reality of requiring low privileges. Note the 1.0.0–1.7.1 window is effectively unauthenticated, which is a more severe access condition than the score captures.
• UI:N — no victim interaction required.
• S:U — impact is confined to Langflow's security scope.
• C:L — limited disclosure of private flow structure, configured values, and selected outputs.
• I:L — limited integrity impact via triggered victim-configured side effects and build-history records; the stored flow itself is not modified.
• A:N — no availability impact.

Blast radius. Any multi-tenant or internet-exposed Langflow deployment spanning the affected range. Single-user, network-isolated deployments have minimal exposure. Business impact centers on cross-tenant data leakage of AI workflow logic and configuration, potential incidental exposure of secrets embedded in component configuration, and unsanctioned execution of victim workflows that may cost money or trigger third-party effects. EPSS is not yet scored by FIRST.org, and CISA KEV status is NO — there is no known exploitation in the wild at time of writing. Patch confidence is 0/4 (UNPATCHED per tracked sources) and no vendor-fix or workaround has been recorded in the tracked sources; however, the advisory text itself states the issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1.

Detection Guidance

Detection focuses on anomalous access to the deprecated, ownership-unchecked build endpoints, especially where the authenticated principal in the session does not match the owner of the referenced flow, and on bursts of vertex enumeration followed by selective vertex execution.

Sigma Rule

title: Langflow Deprecated Build Vertex Endpoint Access (CVE-2026-105698)
id: 8f3c1b2e-1056-98a7-b6c5-1a2b3c4d5e6f
status: experimental
description: Detects access to deprecated Langflow build vertex handlers POST /api/v1/build/{flow_id}/vertices and /vertices/{vertex_id} which lacked flow ownership verification.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105698
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|re: '^/api/v1/build/[0-9a-fA-F-]{36}/vertices(/[^/]+)?$'
  condition: selection_method and selection_uri
  falsepositives:
    - Legitimate single-tenant use of the flow owner's own flow UUID
  level: medium

YARA Rule

rule CVE_2026_105698_Langflow_Build_Vertex_Access
{
    meta:
        description = "Detects Langflow build vertex endpoint references in web logs or captured HTTP request artifacts related to CVE-2026-105698"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105698"
        date = "2026-01-01"
    strings:
        $a = "/api/v1/build/"
        $b = "/vertices"
        $c = "build_graph_from_db_no_cache"
        $d = "retrieve_vertices_order"
        $e = "build_vertex"
    condition:
        ($a and $b) or any of ($c, $d, $e)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105698 Langflow Deprecated Build Vertex Endpoint Access"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/v1/build/"; content:"/vertices"; distance:0; fast_pattern; classtype:attempted-recon; reference:cve,2026-105698; sid:2026105698; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where http.request.method == "POST" and match(http.request.uri, "^/api/v1/build/[0-9a-fA-F-]{36}/vertices$")]
  [http where http.request.method == "POST" and match(http.request.uri, "^/api/v1/build/[0-9a-fA-F-]{36}/vertices/[^/]+$")]

Splunk SPL Query

index=web
| eval uri_lower = lower(uri)
| where match(uri_lower, "^/api/v1/build/[0-9a-fa-f-]{36}/vertices(/[^/]+)?$")
| stats count values(uri) as uris dc(uri) as unique_uris by src_ip user_agent
| where count >= 5 OR unique_uris >= 3
| sort - count

Wazuh OSSEC Rule

<group name="web,langflow,CVE-2026-105698,">
  <rule id="105698" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">POST</field>
    <regex type="pcre2">^/api/v1/build/[0-9a-fA-F-]{36}/vertices(/[^/]+)?$</regex>
    <description>Langflow deprecated build vertex endpoint accessed - possible CVE-2026-105698 flow ownership bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105698,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Block or restrict external and cross-tenant access to POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} at the reverse proxy / API gateway, since these handlers are deprecated and not required by current clients.
• Eliminate unauthenticated reachability: ensure Langflow is behind authentication for all deployments still in the 1.0.0–1.7.1 window.
• Reduce low-privilege reachability by tightening who can authenticate to the Langflow API in 1.7.2–1.10.0 deployments.
• Treat flow UUIDs as sensitive identifiers (they function as the authorization token for this flaw) and review channels where they may be exposed — shared links, exports, logs, and ticketing/image capture.
• Audit component configurations for embedded secrets, as disclosed configured values may include them.

2. Patch / upgrade steps

• Upgrade to Langflow 1.10.1 and langflow-base 0.10.1, the versions in which the issue is fixed per the advisory.
• Track vendor advisories for the authoritative release notes; the tracked sources list no separate vendor-fix record, so validate the fix against the project's release artifacts.

3. Long-term hardening

• Enforce object-level authorization consistently — ownership/tenancy checks must be applied at the handler and at every data-access routine, not inferred from possession of an identifier.
• Remove or fully retire deprecated endpoints rather than leaving them reachable.
• Apply an owner filter to all primary-key lookups of user-owned resources (defense in depth against CWE-639 / IDOR).
• Adopt a least-privilege model for API principals and deploy network segmentation so Langflow is not internet-exposed absent a deliberate decision.
• Enable centralized logging of build endpoint access and alert on cross-principal flow access patterns.

References

• NVD — CVE-2026-105698: https://nvd.nist.gov/vuln/detail/CVE-2026-105698
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-105698 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Langflow project releases (fix versions 1.10.1 / langflow-base 0.10.1): https://github.com/langflow-ai/langflow/releases

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-105698 at time of writing. No public PoC, exploit code, or Nuclei template is available.