CVE-2026-105698: Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:
POST /api/v1/build/{flow_id}/vertices(retrieve_vertices_order)POST /api/v1/build/{flow_id}/vertices/{vertex_id}(build_vertex)
Any authenticated user who knows (or obtains) another user’s flow_id could load that user’s private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response.
Both routes are declared with deprecated=True, include_in_schema=False, so they do not appear in the OpenAPI docs, but they remained registered on the router. The Langflow UI no longer calls them (it uses POST /api/v1/build/{flow_id}/flow), so they are only reachable by direct HTTP requests.
The issue is fixed in Langflow 1.10.1 (langflow-base 0.10.1) by #13153.
References
- github.com/advisories/GHSA-gh98-4phw-6fmw
- github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55
- github.com/langflow-ai/langflow/pull/13153
- github.com/langflow-ai/langflow/releases/tag/v1.10.1
- github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw
- nvd.nist.gov/vuln/detail/CVE-2026-105698
Code Behaviors & Features
Detect and mitigate CVE-2026-105698 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →