Langflow CVE-2026-6597

Exploitation requires the attacker to possess a high-privilege credential (admin or API key with administrative role) on the Langflow instance. This is a critical gate: the vulnerability cannot be triggered by remote unauthenticated users or low-privilege end users of Langflow flows. The vulnerability activates when the Flow Using API component is deployed and credentials have been stored via that component. No special non-default configuration is stated as required, meaning any instance running Langflow ≤1.8.3 with the Flow component enabled and at least one API key stored is vulnerable if a high-privilege actor gains access. The limiting factor is high-privilege authentication; exploitation does not require social engineering, user interaction, or race conditions (AC:L confirms this).

CVSS 2.7 (Low severity) reflects the constraint of PR:H (high privilege requirement), which significantly limits real-world exploitability despite AV:N (network accessible). The EPSS score and KEV status are not provided, but the public POC availability and explicit vendor non-response indicate active interest from attackers. The critical mismatch to evaluate: while the attack vector is remote and unauthenticated accessibility is not required (PR:H), the confidentiality impact is real (C:L). This is NOT a false-positive low score; it is correctly scored because a high-privilege local or API token holder must already be inside the system or authenticated. However, for multi-tenant SaaS deployments of Langflow or environments with overly permissive role-based access controls, the practical risk may be higher than CVSS suggests. The publicly available POC increases attacker capability but does not change the privilege gate. No data on patched versions or vendor response timeline is available, suggesting either ongoing development or abandoned vulnerability.

An insider or attacker who has gained a high-privilege admin token or API key to a Langflow instance can call the remove_api_keys or has_api_terms functions via the Flow Using API to retrieve plaintext copies of stored third-party API credentials (e.g., OpenAI keys, database passwords). These credentials are then used to pivot to dependent services. Alternatively, if Langflow logs credentials during function execution, an attacker with log access can extract them passively. The public POC demonstrates one of these extraction methods.