Langflow Broken Access Control / IDOR in File Handling API
First seen Jul 31, 2026 · Updated Jul 31, 2026 · CVSS 6.5
IBM Langflow, an open-source framework used to build AI agent/LLM workflows, contains two broken access control flaws in its file handling API. One endpoint allows completely unauthenticated retrieval of image files tied to any flow, while another allows authenticated users to access other users' files via an IDOR, breaking tenant isolation in multi-user deployments. This can expose sensitive data stored within private agent flows.
Technical Analysis
The vulnerability resides in Langflow's file-serving API, specifically /api/v1/files/images/{flow_id}/{file_name} and /api/v1/files/download/{flow_id}/{file_name}. The former lacks any authentication/authorization check, letting remote attackers enumerate or guess flow_id/file_name pairs to pull images from arbitrary flows. The latter requires authentication but fails to verify that the requesting user owns the flow_id being accessed, enabling an IDOR where any authenticated user can retrieve files belonging to other tenants. This crosses agent/user boundaries within a shared Langflow deployment, undermining the isolation model that multi-tenant agent-building platforms depend on, and could expose credentials, prompts, uploaded documents, or other sensitive artifacts embedded in flows.
Affected Systems
IBM Langflow
Detection Signatures
- HTTP GET requests to /api/v1/files/images/{flow_id}/{file_name} without Authorization header or session cookie
- Repeated sequential or randomized flow_id values in requests to /api/v1/files/download/ endpoint from a single authenticated user session
- Access logs showing a user_id retrieving flow_id values not associated with their own account
- Unusual spikes in file download/image requests from a single IP across many distinct flow_id values
Remediation Steps
- 1
Upgrade Langflow
Update to a patched Langflow release beyond version 1.8.4 once available from IBM/Langflow maintainers that enforces proper authentication and ownership checks on file endpoints.
- 2
Enforce authentication on image endpoint
Require valid session/auth tokens for /api/v1/files/images/{flow_id}/{file_name} rather than allowing anonymous access.
- 3
Add ownership validation
On /api/v1/files/download/{flow_id}/{file_name}, verify the authenticated user's ownership or authorized access to the specified flow_id before serving files.
- 4
Apply least-privilege file storage
Store per-tenant files in isolated storage paths/buckets with access control lists instead of relying solely on application-layer checks.
- 5
Monitor and rate-limit file API access
Add logging, anomaly detection, and rate limiting on file retrieval endpoints to detect enumeration attempts.
- 6
Restrict network exposure
If not required externally, place Langflow file endpoints behind a VPN, reverse proxy with auth, or internal network only, especially in multi-tenant SaaS deployments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.