CVE-2026-10547

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3

Description Insufficient ownership validation in the deprecated 'POST /api/v1/build/{flow id}/vertices' endpoint allows an authenticated user to inject arbitrary graph data into a shared cache for any flow. This flaw can lead to cross-user cache pollution, unauthorized workflow execution, or denial of service.

Recommendations Update IBM Langflow OSS to a version later than 1.10.3. As a temporary mitigation, restrict access to the 'POST /api/v1/build/{flow id}/vertices' endpoint.