CVE-2026-10700

CVE-2026-10700 affects Langflow versions 1.0.0 through 1.8.4 and targets a specific but significant failure in the file handling subsystem. Two endpoints are vulnerable: /images accepts requests with no authentication whatsoever, while /download requires authentication but never validates that the requesting user owns the referenced flow. These aren't separate bugs—they're symptoms of an access control layer that has authentication infrastructure but no resource ownership enforcement. The CVSS 6.5 rating likely undersells this for multi-tenant deployments. If Langflow is running in any configuration where users from different organizations share the instance—and the description's language about flow ownership implies this is supported—then an attacker who can enumerate or guess flow_ids from other tenants achieves cross-tenant file access. In configurations with data residency requirements or contractual handling obligations, that's a breach notification event, not just a technical bug. Single-tenant deployments face lower risk, but the vulnerability class remains serious. The key question for your environment is whether flow_id is predictable or enumerable. Sequential IDs, hash-based identifiers, or any pattern that allows mass iteration fundamentally changes the severity. Test this directly. If enumeration is trivial, the CVSS becomes academic—your exposure is far worse than the rating suggests. After patching, treat these two endpoints as diagnostic, not complete. The underlying pattern—authentication without ownership validation—almost certainly exists elsewhere in the codebase. Audit the file API, flow API, and related endpoints for the same gap. If the fix addresses only these two calls without introducing a reusable ownership layer, expect structurally identical vulnerabilities to surface in other paths. For operators: prioritize this patch if running multi-tenant configurations and validate your tenant isolation assumptions immediately. The post-disclosure window is when enumeration scripts targeting predictable flow_ids will surface—your remediation lag is the actual exposure window.

Reviewed through automated stages and approved by a human before publication.