Langflow OSS Broken Authorization on Private Flows

Technical Analysis

The vulnerability stems from missing or insufficient ownership checks on flow-access endpoints in Langflow, allowing an authenticated attacker to reference another user's flow ID (e.g., via API or UI) and both view its configuration and trigger its execution. Because flows in Langflow often encapsulate LLM prompts, API keys, tool integrations, and agent chains, unauthorized access crosses a multi-tenant boundary and can leak sensitive data or let an attacker abuse another user's connected tools/credentials. The entry point is the authenticated web/API layer of a shared Langflow instance; no additional social engineering or model manipulation is required. Exploitation grants read access to intellectual property and the ability to execute workflows with the victim's configured permissions and connected services, effectively a horizontal privilege escalation within the platform.

Affected Systems

IBM Langflow OSS

Detection Signatures

• Anomalous access patterns: single user account requesting/executing flow IDs not previously associated with their session
• API logs showing GET/POST to /flows/{id} or /run/{id} endpoints for flow IDs owned by other user accounts
• Unexpected execution of flows outside of the owning user's normal usage window
• Multiple distinct flow_ids accessed sequentially by same authenticated session shortly after login (enumeration pattern)

Remediation Steps

1. 1

   Upgrade Langflow

   Update to the patched Langflow release beyond 1.11.1 that enforces proper per-user authorization checks on flow read/execute endpoints.

2. 2

   Enforce object-level access control

   Verify server-side that flow ownership or explicit sharing permissions are checked on every read and execute request, not just at the UI layer.

3. 3

   Audit flow access logs

   Review historical logs for cross-user flow access or execution events to identify potential prior exploitation.

4. 4

   Rotate embedded credentials

   Rotate any API keys, tokens, or secrets embedded in flows that may have been exposed to unauthorized users.

5. 5

   Apply least-privilege multi-tenancy

   Where possible, isolate tenants/users into separate Langflow instances or namespaces to reduce blast radius of authorization bugs.