EUVD-2026-23760Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth_settings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Langflow up to version 1.8.3 stores authentication settings in cleartext on disk when processing project creation requests, allowing authenticated remote attackers to read sensitive credentials. The vulnerability exists in the create_project/encrypt_auth_settings function within the Project Creation Endpoint, where the auth_settings parameter bypasses encryption despite the function's intent. Publicly available exploit code exists, and the vendor has not released a patch or responded to disclosure notices.
Technical ContextAI
Langflow is an open-source framework for building generative AI applications. The vulnerability resides in the project creation endpoint's authentication settings handler (src/backend/base/Langflow/api/v1/projects.py). The encrypt_auth_settings function is intended to securely encrypt sensitive authentication credentials before persisting them to disk; however, the implementation fails to properly encrypt the auth_settings parameter, resulting in plaintext storage. This violates the confidentiality principle of secure credential management. The underlying issue is classified as CWE-313 (Cleartext Storage of Sensitive Information), a direct information disclosure flaw where sensitive data meant for encryption is written to persistent storage without proper cryptographic protection.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor has not responded to early disclosure attempts. Immediate mitigation requires upgrading to a patched version once available; organizations should monitor the Langflow GitHub repository and official release channels for security updates. As interim compensating controls, restrict network access to Langflow project creation endpoints using network segmentation or reverse proxy rules - allow only authorized internal users or IP ranges to reach /api/v1/projects. Disable user self-service project creation if business logic permits, centralizing project setup to trusted administrators who can verify secure handling. Enable filesystem encryption at rest for all directories containing Langflow's persistent storage (project configuration files), though this protects against physical/offline access but not runtime plaintext exposure. Audit existing projects and rotate any stored authentication credentials (API keys, database passwords, service tokens) exposed through this vulnerability in downstream systems. Consider deploying a secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager) external to Langflow and modify application code to retrieve credentials dynamically rather than storing them in project configurations.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Same weakness CWE-313 – Cleartext Storage in a File or on Disk
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today