IBM Langflow FAISS Namespace Cross-User Access and Poisoning

Technical Analysis

The flaw stems from insufficient namespace isolation in Langflow's FAISS vector store integration, allowing an attacker-controlled session or agent to reference or reuse a namespace identifier belonging to another user rather than being scoped to their own tenant/session. This grants unauthorized read access to another user's private embedded documents (information disclosure) and permits the attacker to insert or overwrite vectors in that namespace, causing subsequent RAG queries by the legitimate owner to retrieve attacker-influenced or poisoned content. The entry point is the vector store API/tool layer within Langflow's flow execution engine, and the boundary crossed is the multi-tenant data isolation boundary between distinct users sharing the same Langflow instance. The impact compounds in agentic pipelines where retrieved content is fed directly into an LLM's context, turning a storage-layer bug into a downstream prompt/context injection vector.

Affected Systems

IBM Langflow OSS

Detection Signatures

• Monitor for FAISS namespace/collection identifiers referenced by sessions/users other than their owning account
• Audit logs for unexpected vector store writes to namespaces not owned by the requesting session
• Alert on anomalous embedding insertions immediately preceding a spike in unrelated user query result changes
• Review Langflow access logs for namespace parameter values that appear guessable, sequential, or reused across distinct user sessions

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched IBM Langflow release beyond version 1.10.1 once available, per vendor advisory.

2. 2

   Enforce namespace isolation

   Apply strict per-tenant/per-user namespace scoping and access control checks at the vector store API layer, validating ownership before read/write operations.

3. 3

   Audit existing vector stores

   Review FAISS namespaces for evidence of unauthorized access or injected/poisoned content and purge or re-embed compromised collections.

4. 4

   Isolate multi-tenant deployments

   Where patching is not immediately possible, deploy separate Langflow instances or vector store backends per tenant to eliminate shared-namespace risk.

5. 5

   Add integrity monitoring

   Implement checksums or provenance tracking on vector store entries to detect unauthorized modifications feeding into RAG pipelines.