CVE-2026-7787: Unauthenticated Session History Access via Public Flow Execution

Synopsis

This is an authentication bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.1 that exposes session history through insecure direct object references (IDORs). An attacker reachable over the network requires no credentials to trigger the flaw, because direct object references in public flow execution endpoints are not access-controlled. Successful exploitation allows the attacker to read sensitive session data and information stored in the affected service. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the Langflow OSS service via a standard network connection.

• AuthenticationNot required

  No credentials are needed; the IDOR flaw allows unauthenticated requests to access protected session history objects directly.

• Victim interactionNot required

  The attacker makes direct requests to the service and does not need any action from a logged-in user or victim.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• An attacker reads session history records belonging to other users, including inputs, outputs, and any data passed through Langflow flows.
• Sensitive configuration details or secrets embedded in flow execution history become accessible without authentication.
• No integrity or availability impact is indicated; data cannot be modified or the service disrupted through this specific vector.