IBM Langflow OSS versions 1.0.0 through 1.9.6 suffer from a missing authentication flaw in the /api/v1/build_public_tmp/ API endpoints. An unauthenticated attacker can either read build event data or issue a cancellation request for a job using a valid job identifier. This lack of access control allows the disclosure of potentially sensitive build information and the interruption of legitimate build processes. The weakness is classified as CWE-287, Authentication Bypass by Spoofing.

The affected product is IBM Langflow OSS deployed on user environments. The vulnerability spans all released versions from 1.0.0 up to 1.9.6 as recorded in the CNA product listings. The vendor explicitly identified these releases as vulnerable in the advisory.

The CVSS score of 8.2 places this issue in the High severity range, reflecting the impact on confidentiality and availability. EPSS information is currently unavailable, so the probability of exploitation remains undetermined but could be significant given the open nature of the endpoint. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known active exploitation at the time of writing. Attackers would require only the ability to send unauthenticated HTTP requests to the exposed API, making the attack vector likely to be the public network or a compromised internal workstation that can reach the service endpoint.