Langflow
CVE-2026-21445
CRITICAL
GHSA-c5cp-vx83-jhqx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to sensitive API endpoint
-
ExploitAccess user conversation data and transaction histories
-
ExecutionPerform message deletion operations
-
ImpactExfiltrate or destroy sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Langflow versions prior to 1.7.0.dev45 with exposed API endpoints lacking authentication controls. No special configuration required — any network-accessible Langflow instance allows unauthenticated access to conversation data and administrative operations by default. |
| Impact | CVSS 9.1 (Critical). Network vector, no auth, low complexity. AI workflow platforms often process sensitive business data through LLM prompts. PoC available, patch available. EPSS 0.07%. |
| Exploit ScenarioDerived | An attacker discovers a Langflow instance, queries the unauthenticated API to dump all user conversations containing proprietary business data, API keys embedded in prompts, and sensitive customer information processed through AI workflows. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to user conversations, transaction data, and message deletion. Critical for AI workflow platforms that handle sensitive prompt data.
Earlier versions of this analysis (1)
Langflow AI workflow platform exposes conversation data, transactions, and destructive operations to unauthenticated users.
RemediationAI
Update to Langflow 1.7.0.dev45 or later. Never expose Langflow to the internet without authentication. Audit conversation logs for sensitive data exposure.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Multiple API endpoints handling personal conversation data and transaction histories lack authentication controls (CWE-306). An attacker can read all user conversations (potentially containing sensitive prompts and AI responses), view transaction histories, and delete messages without any credentials.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
Executive ViewAI
Organizations using Langflow face critical risk from CVE-2026-21445, a missing authentication vulnerability rated CVSS 9.1. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls; (2) Enable MFA where possible; (3) Monitor authentication logs for anomalous access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Exploit-DB