CVE-2026-10560 is a high severity (CVSS 8.2) missing authentication flaw in Langflow OSS 1.0.0 through 1.9.6. Unauthenticated callers who hold a valid job identifier can read build event data or cancel jobs on the build_public_tmp endpoints. IBM recommends upgrading to Langflow 1.10.0.
What's affected
Per IBM's bulletin, Langflow OSS 1.0.0 through 1.9.6 is affected, and IBM strongly recommends upgrading to version 1.10.0. IBM lists no workarounds.
Two endpoints under /api/v1/build_public_tmp/ are named. One streams build events for a job. The other cancels a job. The record says an attacker needs a valid job identifier, so guessing alone is not enough, but the bulletin says the endpoints do not check who is asking or whether the flow is private.
How to check if you're exposed
Check the installed version, and whether the service is reachable from outside:
pip show langflow
langflow --version
If Langflow runs in a container, check the image tag. Then see who can reach the service. A Langflow instance on a shared network or the internet is the case to worry about. Review your reverse proxy logs for requests to build_public_tmp.
What to do now
- Upgrade Langflow to 1.10.0 or later and redeploy.
- Do not expose Langflow to the internet unless you have to. Put it behind authentication at the proxy.
- Treat anything that streamed through a build as potentially seen: IBM's bulletin lists prompts, model responses, API keys and documents from retrieval pipelines as examples of what build events can contain. Rotate keys that appeared.
- Review proxy logs for requests to the build_public_tmp endpoints from unknown addresses.
- Re-run your dependency scan so older Langflow images are not still in use.
Why it matters
Build events are a stream of what the flow is doing. The IBM bulletin says they can include customer prompts, model responses, API keys, internal documents and server-side tracebacks that reveal the file layout. That is a lot of sensitive material for an endpoint that did not ask who was calling.
The record classes it as CWE-287 (improper authentication). The second endpoint is a denial of service risk, since anyone with a job ID can cancel a build.
AI workflow tools often hold keys to model providers and data stores, which raises the cost of an information leak. Inventory them like any other service.
The record does not report exploitation in the wild, and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is guessing a job identifier practical?
The record says a valid job identifier is needed, and neither it nor the bulletin says how hard that is. Do not rely on identifiers staying secret. Upgrade and restrict network access.
Sources
Last reviewed: 19 October 2026.
