CVE-2026-18904 is a high severity (CVSS 8.2) flaw in IBM Langflow OSS 1.0.0 through 1.11.1. A namespace collision between user identifiers lets a remote attacker obtain sensitive information and inject unauthorized messages. IBM's bulletin names 1.11.2 as the fixed version and lists no workaround.
What's affected
IBM's bulletin lists Langflow OSS 1.0.0 through 1.11.1 as affected and says to upgrade to 1.11.2. The bulletin also covers other Langflow issues, including CVE-2026-18891 (improper authentication, 8.2) and CVE-2026-18899 (path traversal, 7.5), so the upgrade matters beyond this one CVE.
IBM lists no workaround. Note that a later bulletin for CVE-2026-19305 names 1.11.3 as the fixed version for another issue, so check for the newest release when you upgrade. The record lists the product as langflow and includes no KEV listing.
How to check if you're exposed
Check the installed Langflow version. For a pip install:
pip show langflow
For a container, check the image tag, and for a managed deployment check the version shown in the application. Anything from 1.0.0 through 1.11.1 is affected.
You can also scan your dependency files for Langflow with the free in-browser scan at gold.safeguard.sh/scan. Then check whether the instance is reachable from the internet, since the attacker is remote and needs no login.
What to do now
- Find every Langflow deployment, including test and personal instances.
- Upgrade to 1.11.2, or to the newest release, which is at least 1.11.3 for related fixes.
- Do not expose Langflow directly to the internet. Put it behind authentication and a reverse proxy.
- Review stored conversations and messages for entries you cannot explain.
- Rotate API keys and credentials stored in flows on instances that were exposed.
- Re-scan your dependencies after the upgrade.
Why it matters
The weakness class is CWE-639, authorization bypass through a user controlled key. Two kinds of identifier land in the same namespace, so a value from one source can be treated as the identifier of another user. When the system uses that identifier to decide whose data to return or where to store a message, an attacker can read or write someone else's records.
The score is 8.2, with high confidentiality impact and low integrity impact. Tools for building AI workflows often store prompts, keys and conversation history, so a read of another user's data can reveal more than it would in a simple app. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes this?
IBM names Langflow OSS 1.11.2 for this CVE. A later bulletin names 1.11.3 for other issues, so use the newest release.
Is a login needed?
No. The vector says no privileges are required.
Sources
Last reviewed: 18 October 2026.
