What is the CVSS score of CVE-2026-33484?

CVE-2026-33484 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-33484?

Yes, a public proof-of-concept exploit is available for CVE-2026-33484. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-33484?

Within 24 hours: Identify all Langflow instances in your environment and document which contain sensitive image data; assess whether multi-tenant or cross-user data sharing occurs. Within 7 days: Implement network-level access controls restricting the /api/v1/files/images endpoint to authenticated users only; deploy WAF rules to require valid authentication tokens; consider disabling the image download feature if not business-critical. Within 30 days: Evaluate alternative secure-by-default AI frameworks; establish timeline for migration away from Langflow or pressure vendor for patch release; conduct data loss assessment for any exposed images.

CVE-2026-33484

HIGH

Improper Access Control (CWE-284)

2026-03-20 https://github.com/langflow-ai/langflow

GHSA-7grx-3xcx-2xv5

Authentication Bypass

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Mar 24, 2026 - 19:20 vuln.today

Public exploit code

Analysis Generated

Mar 20, 2026 - 21:01 vuln.today

CVE Published

Mar 20, 2026 - 20:47 nvd

HIGH 7.5

DescriptionGitHub Advisory

Summary

The /api/v1/files/images/{flow_id}/{file_name} endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200.

Details

src/backend/base/langflow/api/v1/files.py:138-164 - download_image takes flow_id: UUID as a bare path parameter with no Depends(get_flow) or CurrentActiveUser. All other file routes (download_file, upload_file, list_files, delete_file) use Depends(get_flow) which enforces both authentication and ownership. There is no global auth middleware on /api/v1; protection is per-endpoint only.

PoC

curl -v "http://localhost:7860/api/v1/files/images/<flow_uuid>/<filename.png>"
# Returns HTTP 200 with image bytes, no auth header required

Impact

Unauthenticated cross-tenant data leak. In a multi-tenant deployment, any attacker who can discover or guess a flow_id (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials.

AnalysisAI

The Langflow Python package contains an authentication bypass vulnerability in its image file download endpoint that allows unauthenticated attackers to access image files uploaded by any user. Langflow, a visual framework for building AI applications, fails to enforce authentication and ownership checks on the /api/v1/files/images/{flow_id}/{file_name} endpoint, while all other file operation endpoints properly implement these security controls. A proof-of-concept exploit exists demonstrating that any attacker with knowledge of a flow UUID and filename can retrieve sensitive image data without credentials, posing a critical risk in multi-tenant deployments where cross-tenant data leakage can occur.

Technical ContextAI

Langflow is a Python-based visual framework for building and deploying AI workflows and chatbots, distributed via PyPI (pkg:pip/langflow). The vulnerability exists in the FastAPI-based REST API layer, specifically in the download_image function located in src/backend/base/langflow/api/v1/files.py at lines 138-164. Unlike the properly secured endpoints (download_file, upload_file, list_files, delete_file) that use the Depends(get_flow) dependency injection to enforce authentication and ownership verification, the vulnerable download_image endpoint accepts flow_id as a bare UUID path parameter with no authentication middleware. This represents a classic instance of CWE-284 (Improper Access Control) where security controls are inconsistently applied across similar API endpoints. The application lacks global authentication middleware on the /api/v1 route prefix, instead relying on per-endpoint protection using FastAPI's dependency injection system, which was omitted for this specific endpoint.

RemediationAI

Organizations running Langflow should immediately consult the GitHub security advisory at https://github.com/langflow-ai/langflow/security/advisories/GHSA-7grx-3xcx-2xv5 for the patched version and upgrade guidance. The fix requires adding authentication and ownership verification to the download_image endpoint in src/backend/base/langflow/api/v1/files.py by implementing the Depends(get_flow) dependency injection pattern already used by other file operation endpoints, along with a CurrentActiveUser dependency to validate the requestor's identity and authorization. Until patching is completed, organizations should implement network-level access controls to restrict the /api/v1/files/images/ endpoint to authenticated users only, either through a reverse proxy with authentication enforcement, IP allowlisting for trusted networks, or by disabling the endpoint entirely if image serving through the API is not business-critical. For multi-tenant deployments, immediate patching is essential as no effective workaround can prevent cross-tenant data leakage once an attacker has discovered valid flow UUIDs.