Langflow CVE-2026-6598

An authenticated Langflow user account is required to invoke the project creation endpoint; the vulnerability cannot be exploited by unauthenticated remote attackers. The attack requires submission of the auth_settings parameter to the /api/v1/projects POST endpoint - this parameter is typically populated when users configure authentication for downstream services (e.g., LLM API keys, database credentials). The encryption function is intended to protect these settings but fails to do so, meaning any project creation request with auth_settings will result in plaintext storage. No additional non-default configuration is required; the vulnerability exists in the default behavior of the project creation function. Exploitation is limited to reading stored credentials and does not permit modification or deletion of project data, as the CVSS vector shows no integrity or availability impact.

The CVSS score of 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects low-to-moderate severity: network-accessible, low attack complexity, and low confidentiality impact, but requiring prior authentication (PR:L). The E:P evidence modifier indicates publicly available proof-of-concept code, elevating practical risk beyond the base score. The lack of integrity or availability impact limits immediate system compromise, but exposed authentication settings create secondary risks: stored API keys, database credentials, or third-party service tokens could enable privilege escalation or lateral movement in downstream systems. The combination of low barrier to entry (authenticated user, no interaction), persistent nature of the flaw, and vendor non-response suggests this warrants immediate attention for organizations running Langflow. However, the attack requires valid user credentials to the Langflow platform itself, which partially mitigates risk in air-gapped or internally-deployed instances. Real-world priority depends on whether Langflow instances are internet-facing and whether user authentication is properly enforced.

A legitimate Langflow user with valid authentication credentials creates a new project and supplies third-party service authentication details (e.g., OpenAI API key, database password) via the auth_settings parameter. Instead of being encrypted and stored securely, these credentials are written in plaintext to the project configuration file on the server's filesystem. An attacker with read access to the server's filesystem (via another vulnerability, insider threat, or backup exposure) retrieves the plaintext credentials and uses them to compromise downstream services or exfiltrate sensitive data. Publicly available exploit code demonstrates this plaintext extraction, enabling rapid weaponization.