{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /api/v2/workflows with x-api-key header and JSON body {flow_id: victim_flow_uuid, inputs: {ChatInput-<id>.input_value: <probe>}} against running Langflow 1.9.0 server (LANGFLOW_DEVELOPER_API_ENABLED=true)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "langflow 1.9.0 (langflow-base 0.9.0, commit f52d0f0072)",
    "sqlite",
    "uvicorn",
    "developer_api_enabled=true"
  ],
  "proof_artifacts": [
    "logs/vuln_variant/reproduction_steps.log",
    "logs/vuln_variant/langflow_server_vuln.log",
    "logs/vuln_variant/langflow_server_fixed.log",
    "vuln_variant/artifacts/victim_register.json",
    "vuln_variant/artifacts/attacker_register.json",
    "vuln_variant/artifacts/victim_flow_create.json",
    "vuln_variant/artifacts/ownership_victim_get.txt",
    "vuln_variant/artifacts/ownership_attacker_get.txt",
    "vuln_variant/artifacts/variant_response_vuln.json",
    "vuln_variant/artifacts/variant_response_fixed.json",
    "vuln_variant/artifacts/summary.json"
  ],
  "variant_reproduced_on_vulnerable": true,
  "variant_blocked_on_fixed": true,
  "notes": "variant=/api/v2/workflows; vuln_idor=true fixed_blocked=true | outcome=alternate_trigger"
}