CVE-2026-10547: Medium Cache Poisoning in IBM Langflow OSS

CVE-2026-10547 is a Medium severity access control flaw in IBM Langflow OSS 1.0.0 through 1.10.3. The deprecated vertices build endpoint does not check flow ownership, so an authenticated user can inject graph data into a shared cache for any flow. IBM recommends upgrading to Langflow OSS 1.11.0 or newer.

What's affected

• Product: IBM Langflow OSS, the open source visual builder for AI workflows.
• Affected: 1.0.0 through 1.10.3, per the record and the IBM bulletin.
• Fixed: IBM recommends Langflow OSS 1.11.0 or newer.
• Component: the deprecated build vertices endpoint under /api/v1/build.
• Precondition: an authenticated user. IBM's CVSS 3.1 base score is 5.9, matching the record.
• Workarounds: IBM lists none.

How to check if you're exposed

Find each Langflow deployment and its version.

pip show langflow
pip freeze | grep -i langflow
docker ps --format "table NAMES\tIMAGE" | grep -i langflow

Then look at who can log in. The flaw needs an authenticated user, so a single user instance on a laptop is far less exposed than a shared team server. If the instance is multi user, list the accounts and ask whether each still needs access.

You can also check access logs for calls to the deprecated build vertices endpoint from clients that should not use it. The IBM page is a shared bulletin that covers several Langflow CVEs, so read it for the others too.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.

What to do now

1. Upgrade Langflow OSS to 1.11.0 or newer, following IBM's guidance, and test your flows afterwards.
2. Review the user list on shared instances and remove accounts you do not need.
3. Do not expose Langflow to the public internet. Place it behind a VPN or an authenticating reverse proxy.
4. Review flows for unexpected changes or executions that nobody on the team started, since the issue allows unauthorized workflow execution.
5. Keep secrets used by flows scoped to the minimum, so one injected flow reaches little.
6. Subscribe to IBM security bulletins for Langflow.

Why it matters

The record lists CWE-284, improper access control. The endpoint accepts a flow identifier but does not verify that the caller owns that flow. Because build data goes into a cache shared across users, one user's request can change what another user's flow loads.

The record names three possible outcomes: cross user cache pollution, unauthorized workflow execution and denial of service. Workflow execution is the serious one. AI workflow tools often hold API keys and connections to internal systems, so running someone else's flow can reach far.

The score is moderate because it needs a login and the attack is not trivial, with a high complexity rating in IBM's vector. The record does not list this CVE as exploited in the wild. The same IBM bulletin covers more serious Langflow issues, which is another reason to upgrade past 1.10.3.

Quick check

Sources

• IBM security bulletin

Last reviewed: 18 October 2026.