IBM Langflow OSS Insecure Direct Object Reference Vulnerability Allowing Cross-User Data Access and Deletion

An insecure direct object reference vulnerability has been identified in IBM Langflow OSS versions 1.0.0 through 1.8.4. This vulnerability allows authenticated users to manipulate data belonging to other users by supplying arbitrary flow_id values. The affected Monitor API endpoints lack proper authorization checks, enabling access to sensitive transaction logs and vertex build data from other users' flows. Additionally, this vulnerability allows for the deletion of persisted vertex build data for another user's flow.

Impact

Exploitation of this vulnerability could lead to unauthorized access to and manipulation of another user's transaction logs and vertex build data, including the deletion of build data.

Remediation

Users are advised to upgrade to Langflow OSS version 1.9.0 or newer.