CVE-2026-6542 — Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id
IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted ve…
Published: 2026-04-30 · CVSS: 6.5 · CVSS 3.1
IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7