IBM Langflow Broken Access Control on Build Job/Log Endpoints

Technical Analysis

The flaw stems from missing or insufficient authorization checks on Langflow's build job and log retrieval endpoints, likely due to predictable job/build identifiers (IDOR-style) combined with endpoints that do not enforce ownership or session validation. An authenticated attacker can enumerate or guess build job IDs belonging to other tenants to read logs (potentially leaking prompts, credentials, API keys, or intermediate agent reasoning) or manipulate build state, and some endpoints are reachable without authentication entirely, widening the exposure to unauthenticated network-adjacent attackers. This crosses tenant/agent isolation boundaries within a shared Langflow instance, meaning one user's agent pipeline data and execution state can leak into or be altered by another user's session. The primary gain for an attacker is unauthorized access to sensitive build artifacts and the ability to disrupt or tamper with another tenant's agent workflows.

Affected Systems

Langflow

Detection Signatures

• Unusual access patterns to /api/*/build or /api/*/logs endpoints from user sessions not matching job owner
• Requests to build/log endpoints lacking Authorization headers or valid session tokens that still return 200
• Sequential or enumerated build/job ID access patterns in access logs
• Cross-tenant access to build job resources not owned by requesting user ID

Remediation Steps

1. 1

   Upgrade Langflow

   Update to the patched Langflow release beyond 1.10.1 that enforces proper access control on build and log endpoints.

2. 2

   Enforce ownership checks

   Ensure server-side authorization validates that the requesting user owns or has explicit permission for the build job/log resource before returning data.

3. 3

   Require authentication on all build endpoints

   Audit and close any unauthenticated build endpoints; require valid session/API tokens for all job and log retrieval routes.

4. 4

   Rotate exposed secrets

   If logs may contain API keys, credentials, or sensitive prompts, rotate any secrets that could have been exposed via cross-tenant log access.

5. 5

   Restrict network exposure

   Place Langflow instances behind authenticated reverse proxies and avoid exposing build/log endpoints directly to the internet in multi-tenant deployments.