CVE-2026-34046
HighSummary
Langflow prior to version 1.5.1 had a security vulnerability that allowed authenticated users to access other users' flows without ownership checks. The issue stemmed from the lack of proper query filtering based on the `AUTO_LOGIN` setting.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, such as API keys, as well as the ability to modify or delete other users' flows. This poses a risk to data privacy and integrity.
Recommendation
It is recommended to update Langflow to version 1.5.1 or later to eliminate the security vulnerability and ensure proper query filtering. Additionally, conducting a data access audit to identify potential breaches is advisable.
Other vulnerabilities in Langflow
See all- CVE-2026-55450Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.1, unauthenticated users can upload unlimited amounts of data to the server, leading to space exhaustion. Additionally, the server response reveals the absolute path of the uploaded file, which constitutes an information leak.
- CVE-2026-55255HighActively exploited
In Langflow prior to 1.9.1, an IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
- CVE-2026-42048Critical
Langflow, a tool for building and deploying AI agents, is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases) prior to version 1.9.0. An attacker can exploit this flaw to delete arbitrary directories on the server.
- CVE-2026-33017Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allowed building public flows without requiring authentication, leading to the possibility of remote code execution by unauthorized users.
- CVE-2026-0770CriticalActively exploited
A vulnerability in Langflow allows remote code execution via the exec_globals parameter in the validate endpoint. An unauthenticated attacker can inject malicious code from an untrusted source.
- CVE-2026-21445Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
- CVE-2025-34291HighActively exploited
A vulnerability in Langflow versions up to and including 1.6.9 enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie set as SameSite=None allows a malicious webpage to perform cross-origin requests with credentials and call the refresh endpoint. An attacker can obtain fresh access_token/refresh_token pairs for a victim session and use them to execute arbitrary code, leading to full system compromise.
- CVE-2025-3248CriticalActively exploited
Langflow versions prior to 1.3.0 are vulnerable to code injection via the /api/v1/validate/code endpoint. An unauthenticated remote attacker can execute arbitrary code by sending crafted HTTP requests.
- CVE-2026-55446High
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.0.19, an attacker could send a /api/v1/files/upload/ request without an authentication token/cookies, leading to the langflow app becoming unusable for all users for an indefinite amount of time.
- CVE-2026-55423Medium
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, the logout button does not clear the session, allowing the previous user to remain logged in unless another user explicitly logs in.
Original NVD description (English source)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the reques