EUVD-2026-16664Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').
AnalysisAI
Log router endpoints in an authenticated application expose full application log buffers to any authenticated user without privilege-level authorization checks, allowing credential harvesting, sensitive data exfiltration, and reconnaissance. The vulnerability affects the '/logs' and '/logs-stream' endpoints which enforce only basic authentication ('get_current_active_user') rather than administrative privilege requirements, enabling authenticated attackers with low privileges to read complete application logs containing sensitive information. No public exploit code or active exploitation has been identified at the time of analysis, though the relatively low attack complexity (AC:L) and straightforward authentication bypass mechanism present moderate real-world risk.
Technical ContextAI
The vulnerability stems from a missing authorization control (CWE-862: Missing Authorization) in a log router component that implements two HTTP endpoints for log retrieval. The endpoints rely exclusively on FastAPI's 'get_current_active_user' dependency, which verifies user authentication but performs no role-based access control (RBAC) or privilege validation (no 'is_superuser' or equivalent administrative check). The CVSS vector AV:N/AC:L/PR:L indicates the flaw is remotely exploitable over a network with low complexity once a valid authenticated credential is obtained. The affected technology appears to be a Python-based web application using FastAPI or similar framework, where authentication is decoupled from authorization, allowing vertical privilege escalation from standard user to log-reading capabilities normally reserved for administrators.
RemediationAI
The primary remediation is to implement role-based access control (RBAC) on the '/logs' and '/logs-stream' endpoints by adding authorization checks (e.g., 'is_superuser' or equivalent privilege validation) to the endpoint dependencies. In FastAPI, this involves modifying the dependency chain from 'get_current_active_user' to a compound dependency such as 'get_current_admin_user' that verifies both authentication and administrative privilege before granting access. As an interim workaround pending code deployment, restrict network access to the log endpoints via reverse proxy rules, API gateway policies, or firewall rules to limit exposure to trusted administrator IP ranges only. Additionally, audit existing access logs to identify if low-privilege accounts have accessed '/logs' or '/logs-stream' endpoints, and rotate any credentials or secrets that may have been exposed. The vendor advisory reference (https://www.tenable.com/security/research/tra-2026-23) should be consulted for detailed patching guidance and any vendor-specific mitigation recommendations.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today