TagsTags

idor

1 entry1 entrada

postOct 19, 2026CVE-2026-17627
CVE-2026-17627: Reaching another user's flow through Langflow's voice-mode WebSocket
Langflow's voice-mode WebSocket authenticated the caller but never checked they owned the flow named in the URL, so any user could read another tenant's flow and inject messages into its history.
cvelangflowidorauthorizationresearch

artigo19 out 2026CVE-2026-17627
CVE-2026-17627: alcançando o flow de outro usuário pelo WebSocket de voz do Langflow
O WebSocket de voz do Langflow autenticava o chamador, mas nunca verificava se ele era dono do flow informado na URL — então qualquer usuário podia ler o flow de outro e injetar mensagens no histórico dele.
cvelangflowidorauthorizationresearch

All tags →Todas as tags →