Offensive Testing
Penetration TestingVulnerability AssessmentsRed Team Engagements
Advisory & Research
AI Launch Risk ReviewSecurity Architecture ReviewSecurity ResearchSecurity Awareness Training
Software
Breachwright
Community
AI Security DatabaseAdvent Prompt PwnField Manual
ResearchAboutContact
Get in Touch
← Back to the database
high · 7.1Maintainer reviewedAASD-2026-0006

Langflow FAISS namespace reuse exposes and poisons another user's vector content

Langflow OSS 1.0.0 through 1.10.1 persisted FAISS indexes without adequately scoping their namespaces to the authenticated user. A low-privilege user who selected another user's namespace could retrieve owner-only vector content and persist attacker-controlled content that influenced later query results.

Prerequisites

  • The attacker has an authenticated Langflow account with access to a vulnerable FAISS component
  • Another user has persisted a FAISS index in the same Langflow deployment

Potential impact

  • Disclosure of vector content persisted by another Langflow user
  • Persistent modification of later query results through cross-user vector-content poisoning

Mitigations

  • Upgrade Langflow OSS to version 1.10.2 or later
  • Restrict vector-store creation and persistence to trusted users until the upgrade is complete
  • Run separate Langflow deployments or storage roots for mutually untrusted tenants when an immediate upgrade is not possible
  • Review and rebuild persisted FAISS indexes if cross-user namespace reuse may have occurred

Public sources

vendor advisorycve recordpatchrelease

Research note

IBM's bulletin does not publish a researcher credit. Langflow 1.10.2 scopes persisted FAISS indexes to a deterministic per-user directory and rejects path-like index names. Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-29.