Langflow Chroma Vector Store Namespace Collision Cross-Tenant Data Leak
First seen Jul 31, 2026 · Updated Jul 31, 2026 · CVSS 8.1
IBM Langflow OSS fails to enforce per-user isolation of Chroma vector store collections, allowing any authenticated attacker to guess or reuse another user's persist_directory and collection_name to read their private documents. The same flaw lets an attacker write poisoned documents into the victim's namespace, corrupting the data that victim's RAG workflows retrieve on. This is a straightforward multi-tenancy authorization failure rather than a novel agentic exploit, but it directly compromises confidentiality and integrity of agent memory.
Technical Analysis
Langflow lets users define flows that reference a Chroma vector store via persist_directory and collection_name parameters, but the application does not scope these identifiers to the owning user or tenant, and does not verify flow ownership before granting access to the underlying collection. An attacker who knows or brute-forces these naming values can construct their own flow pointing at the same physical Chroma collection, causing Langflow's retrieval nodes to return the victim's stored embeddings/documents directly in the attacker's workflow output. Because writes are similarly unauthenticated at the namespace level, the attacker can also insert or overwrite documents in the shared collection, effectively poisoning the memory store any downstream agent or RAG pipeline reads from. The entry point is the flow-authoring/API layer; the boundary crossed is user/tenant isolation within a shared vector database backend, not a sandbox or model boundary.
Affected Systems
IBM Langflow OSS
Detection Signatures
- Multiple distinct user accounts referencing identical persist_directory + collection_name pairs in flow configs
- Unexpected documents appearing in a Chroma collection not authored by the collection owner
- Retrieval node output containing content/metadata not present in the querying user's uploaded documents
- Audit logs showing cross-user access to the same underlying Chroma storage path without corresponding flow-sharing permissions
Remediation Steps
- 1
Upgrade Langflow
Apply the vendor patch for CVE-2026-13444 as soon as it is released; track IBM Langflow security advisories for the fixed version beyond 1.10.1.
- 2
Enforce per-tenant namespace scoping
Derive persist_directory/collection_name deterministically from an authenticated user or tenant ID server-side, rather than trusting user-supplied values, so collisions are impossible.
- 3
Add ownership checks on vector store access
Verify flow/collection ownership at both read and write time before allowing Chroma queries or inserts, independent of the naming values supplied in the flow definition.
- 4
Audit existing collections
Review current Chroma storage for shared/colliding namespaces across users and rotate or re-isolate any collections found to be commingled.
- 5
Monitor for poisoning
Add integrity checks (hashing, provenance metadata) on stored documents to detect unauthorized insertions into vector collections.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.