CVE-2026-9225

Executive Summary

CVE-2026-9225 is an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) in IBM Langflow OSS versions 1.0.0 through 1.11.5 that allows an authenticated low-privileged attacker to read files belonging to other users. The flaw resides in the File/Read File component and is triggered when flows are executed through the /api/v1/run/advanced/{flow_id} endpoint, where component inputs can reference arbitrary user or flow storage identifiers without verifying ownership. Successful exploitation results in unauthorized disclosure of sensitive user-uploaded data across tenant or user boundaries, with high confidentiality impact (CVSS 6.5, C:H/I:N/A:N).

Technical Analysis

Langflow is an open-source low-code platform for building and deploying AI/LLM workflows. Users construct "flows" composed of components, one of which is the File/Read File component that reads uploaded file content from backend storage. The platform exposes a file management API that enforces authorization checks, ensuring a user can only access files within their own storage namespace.

CVE-2026-9225 is an authorization bypass through a user-controlled key. The core weakness is that ownership of a referenced storage path is not validated at the point where a flow executes. The NVD description states that when executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. This means the vulnerable File/Read File component trusts the storage path key supplied within the flow input and resolves it directly against backend storage rather than constraining it to the caller's own namespace.

The vulnerability class is CWE-639: the security decision (may this principal read this file?) is based on a key value supplied by the attacker rather than on a server-side ownership check tied to the authenticated identity. A low-privileged authenticated user who can create or execute a flow can set the file path to point to another user's storage namespace. Because the /api/v1/run/advanced/ path bypasses the intended authorization checks that the file management API would otherwise enforce, the backend reads and returns the target file's contents to the attacker.

Because the description is precise about the vulnerable component (File/Read File), the execution endpoint (/api/v1/run/advanced/{flow_id}), and the bypassed control (file management API authorization), no additional implementation details are inferred. No function names, parameter names, or internal storage path formats beyond those stated can be responsibly asserted, and none are invented here.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a network-reachable flaw requiring only low privileges, no user interaction, and yielding high confidentiality loss with no integrity or availability impact.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the stated vulnerability class and the NVD description. Only the endpoint, component, and identifiers explicitly named in the description are used.

1. Reconnaissance/target identification: The attacker identifies a reachable Langflow OSS instance (versions 1.0.0 through 1.11.5) and obtains low-privileged authenticated access — i.e., a valid account that permits creating and executing flows but is not an administrator. The attacker enumerates or guesses flow identifiers (flow_id) and user or flow storage identifiers used in the backend namespace.

2. Triggering the flaw: The attacker creates or modifies a flow containing the File/Read File component and supplies a crafted file path in that component's input that references another user's storage namespace rather than their own. Because the component accepts arbitrary user or flow identifiers without an ownership check, the attacker-controlled key is not validated against their identity.

3. Payload/execution method: The attacker invokes the flow via the /api/v1/run/advanced/{flow_id} endpoint. At the vulnerability-class level, this is an authorization bypass through a user-controlled key: the missing server-side ownership check causes the backend to resolve the attacker-supplied path and return the referenced file's content. No crafted serialized payload is required beyond a modified file path value — the attacker abuses legitimate functionality.

4. Post-exploitation impact: The response returns the contents of files uploaded by other users, resulting in unauthorized disclosure of potentially sensitive user data. The attacker can iterate over identifiers to harvest multiple files, using the high confidentiality impact to exfiltrate data that the file management API's authorization checks would normally protect.

Impact Assessment

The primary impact is confidentiality loss rated High (C:H), with no integrity (I:N) or availability (A:N) impact, scope Unchanged (S:U), and a base score of 6.5 (Medium). Exploitation requires authentication (PR:L), is network-reachable (AV:N), needs no special conditions (AC:L), and requires no victim interaction (UI:N).

Affected systems are Langflow OSS deployments in the 1.0.0–1.11.5 range that are multi-user or multi-tenant, or that isolate users' uploaded files. Blast radius depends on how many distinct user namespaces exist and how predictable their identifiers are: a single low-privileged account can potentially retrieve files belonging to all other users whose identifiers it can enumerate. The business impact includes exposure of user-uploaded content — which in LLM workflows may include documents, datasets, prompts, or configuration containing sensitive business or personal data — regulatory and privacy exposure from cross-user data disclosure, and erosion of trust in the platform's tenant isolation. Because exploitation abuses normal flow execution, the activity may blend with legitimate API traffic, complicating detection.

Detection Guidance

Sigma Rule

title: Langflow File/Read File Authorization Bypass via Advanced Run Endpoint (CVE-2026-9225)
id: 8f3a1c72-9225-4b1e-9d5c-1a2b3c4d5e6f
status: experimental
description: Detects requests to the Langflow /api/v1/run/advanced/ endpoint that may indicate an attempt to read files outside the caller's storage namespace by supplying arbitrary user or flow identifiers.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-9225
author: Threat Intelligence Team
logsource:
  category: webserver
  product: langflow
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/api/v1/run/advanced/'
  selection_readfile:
    cs-uri-query|contains:
      - 'file'
      - 'path'
  condition: selection_endpoint
level: medium
tags:
  - attack.t1213
  - cve.2026.9225

YARA Rule

rule CVE_2026_9225_Langflow_ReadFile_Bypass
{
    meta:
        description = "Detects references to Langflow advanced run endpoint and File/Read File component consistent with CVE-2026-9225 exploitation attempts in logs or captured traffic"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-9225"
        date = "2026-01-01"
        cve = "CVE-2026-9225"

    strings:
        $ep = "/api/v1/run/advanced/" ascii wide nocase
        $comp = "Read File" ascii wide nocase
        $flows = "file" ascii wide nocase

    condition:
        $ep and ($comp or $flows)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-9225 Langflow Advanced Run Endpoint Access Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/run/advanced/"; nocase; classtype:attempted-recon; reference:cve,2026-9225; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-9225; sid:9026001; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where url.path : "/api/v1/run/advanced/*" and http.request.method == "POST" ]
  [ network where url.path : "/api/v1/run/advanced/*" and http.request.method == "POST" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=langflow
| search uri_path="/api/v1/run/advanced/*" method=POST
| stats count values(uri_query) as queries dc(clientip) as clients by user, srchost, uri_path
| where count >= 1
| table _time, user, src_ip, uri_path, queries, count

Wazuh OSSEC Rule

<group name="langflow,web,cve-2026-9225,">
  <rule id="100925" level="10">
    <if_sid>31100</if_sid>
    <url>/api/v1/run/advanced/</url>
    <description>CVE-2026-9225: Possible Langflow File/Read File authorization bypass attempt via advanced run endpoint</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_9225,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor fix available):

• Restrict network access to the Langflow API so that only trusted clients can reach /api/v1/run/advanced/{flow_id}; place it behind authentication-aware reverse proxies or VPN.
• Limit and audit the set of users permitted to create or execute flows; reduce the number of low-privileged accounts that can invoke flow execution.
• Enforce server-side ownership validation at a compensating control layer (e.g., a reverse proxy or gateway that maps the caller identity to permitted storage namespaces) where feasible.
• Monitor flows containing the File/Read File component and review any that reference paths outside the creating user's namespace.
• Treat all Langflow OSS deployments in the 1.0.0–1.11.5 range as vulnerable until a fix is confirmed.

2. Patch/upgrade steps:

• No patch reference or fixed version is available from any tracked source. Monitor the vendor and the NVD entry for CVE-2026-9225 for a fixed release.
• When a patched version is published, upgrade immediately and validate that the File/Read File component and the /api/v1/run/advanced/{flow_id} endpoint enforce ownership checks.

3. Long-term hardening:

• Adopt an object-level authorization (IDOR/BOLA) test regime covering all endpoints that accept user- or flow-controlled identifiers.
• Require that all file access decisions be made against the authenticated principal's identity rather than attacker-supplied keys (address CWE-639 at the design level).
• Implement centralized, immutable audit logging of file-read operations correlated with the requesting user.
• Segment tenants/users so that storage namespaces cannot be referenced across identities.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9225
• CWE-639: Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• IBM Langflow product page / advisory channel (monitor for a vendor fix): https://www.ibm.com/
• Langflow open-source project repository and release notes (monitor for patched version): https://github.com/langflow-ai/langflow
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-9225 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence was available at the time of writing. EPSS has not yet been scored by FIRST.org; no EPSS value is reported. No known threat actor campaigns are associated with this CVE based on the provided data.