CVE-2026-10547

CVE-2026-10547 affects IBM Langflow OSS 1.0.0 through 1.10.3. The issue lies in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint where ownership validation is insufficient, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This can lead t...