CVE-2026-17627 is an authorization flaw in the voice mode of Langflow OSS 1.0.0 through 1.10.2. A signed-in user who knows another user's flow identifier could read that flow's description and insert messages into its history. It scores 4.9, Medium. IBM recommends upgrading to 1.10.3.
What's affected
Langflow OSS 1.0.0 through 1.10.2, per IBM's bulletin (node 7286294, first published 3 September 2026, modified 16 October 2026). IBM strongly recommends upgrading to Langflow OSS 1.10.3 and lists no workaround.
Note the version difference from related bulletins. The other Langflow CVEs published around the same time list 1.0.0 through 1.10.3 and need 1.11.0. This one stops at 1.10.2 and is fixed in 1.10.3. If you upgrade to 1.11.0 or newer for the other issues, you cover this one too.
The record scores it 4.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. The vector is network, high complexity, low privileges and changed scope, with low confidentiality and integrity impact. IBM's bulletin gives the same 4.9.
How to check if you're exposed
Check the installed Langflow version.
pip show langflow
docker image ls | grep -i langflow
Anything from 1.0.0 to 1.10.2 is in range. Then consider whether it matters for you. The advisory describes a multi-user deployment: one authenticated user reaching another user's flow. On a single-user install with no other accounts, there is nobody to attack. If you use voice mode with a shared server, you are in scope.
What to do now
- Find every Langflow install and record its version.
- Upgrade to 1.10.3 at least, and preferably 1.11.0 or newer, which covers the other recent Langflow bulletins.
- On shared servers, review who has accounts, and avoid sharing flow identifiers in tickets and chat.
- Look at conversation histories in voice-mode flows for messages the owner did not write.
- Langflow can run user-supplied Python and connects to external tools, so keep instances off the open internet and behind authentication, and run it as a low-privilege user with limited network access.
Why it matters
The record classes the weakness as CWE-639, Authorization Bypass Through User-Controlled Key. Voice mode in Langflow uses a WebSocket endpoint that takes a flow identifier in the URL and uses it to fetch the flow's description and to save conversation messages against that flow. IBM says the endpoint checks who you are and that you have a personal OpenAI API key, but does not check that you may use that particular flow. The record classes the weakness as CWE-639, authorization bypass through a user-controlled key.
Two things follow, according to IBM: the attacker can read the flow's description field, and can inject messages into its conversation history, which the owner will later see in their own message monitor. IBM also notes that flow execution is not affected, because the execution path has a separate authorization check.
That last point is why the score is Medium. Nothing here runs the victim's flow or gives access to its secrets. But injected messages in a record that people trust can mislead, and a description field can contain internal notes. The attacker also needs to know the flow identifier, which keeps the bar higher. It is a tidy example of the common rule: identifying who someone is does not decide what they may touch. No exploitation is reported, and the CVE is not in the CISA catalog.
Quick check
Does the attacker need to know something about the target?
Yes. IBM says they need to know another user's flow identifier.
Can the attacker run my flow?
IBM says flow execution is not affected, because the execution path applies a separate authorization check.
Sources
- IBM Security Bulletin 7286294: Langflow voice mode, fetched 18 October 2026
Last reviewed: 18 October 2026.
