IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a flaw where the system does not properly enforce ownership validation on the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. An authenticated user can inject arbitrary graph data into a shared cache belonging to any flow. This misvalidation can result in cross‑user cache pollution, unauthorized workflow execution, or denial of service. The absence of proper access control enables the injected payload to be executed or used by other users, effectively allowing an attacker to run unauthorized code within the application context.

Affected vendors are IBM, product Langflow OSS. Versions 1.0.0 through 1.10.3 are impacted. The update available from IBM starts at Langflow OSS 1.11.0.

The CVSS base score is 5.9, indicating a moderate security impact. EPSS data is not available, so the current likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV. The attack vector requires authenticated access to the deprecated API endpoint, meaning an attacker must first gain a legitimate user account or otherwise obtain credentials for the system. Once authenticated, the attacker can execute the flaw by sending specially crafted requests to the endpoint, leading to arbitrary code execution or denial of service within the shared cache environment.