EUVD-2026-16664Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 6.5 (Medium severity) reflects confidentiality impact (C:H) with no integrity or availability impact, which aligns with log exposure scenarios. The CVSS vector AV:N/AC:L/PR:L indicates this requires network access and valid authentication, reducing opportunistic exploitation but increasing risk for insider threats or attackers with compromised low-privilege credentials. The missing authorization pattern (CWE-862) is a common but serious flaw in modern API design. Exploitation likelihood is moderate: while no KEV status or public POC is confirmed, the vulnerability requires only valid credentials and a simple HTTP GET request to '/logs' endpoint - well within the capability of any authenticated user or compromised account holder. In a multi-tenant or role-segregated environment, this becomes high-priority; in a single-tenant admin-only deployment, risk is lower. The lack of complexity (AC:L) and the sensitive nature of application logs (often containing secrets, PII, error traces) suggest this should be remediated promptly despite medium CVSS scoring. |
| Exploit ScenarioDerived | An attacker gains valid login credentials for a standard user account (via phishing, credential stuffing, or insider access) and authenticates to the web application. The attacker then performs a simple HTTP GET request to 'https://target.app/logs' or streams logs via '/logs-stream', bypassing the missing authorization checks and immediately receiving the complete application log buffer. Within the logs, the attacker discovers database connection strings, API keys, session tokens, or other sensitive secrets in error messages and debug output, then uses these to escalate to database or downstream system access. No specialized exploit code is required - standard HTTP clients and curl commands suffice. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Log router endpoints in an authenticated application expose full application log buffers to any authenticated user without privilege-level authorization checks, allowing credential harvesting, sensitive data exfiltration, and reconnaissance. The vulnerability affects the '/logs' and '/logs-stream' endpoints which enforce only basic authentication ('get_current_active_user') rather than administrative privilege requirements, enabling authenticated attackers with low privileges to read complete application logs containing sensitive information. No public exploit code or active exploitation has been identified at the time of analysis, though the relatively low attack complexity (AC:L) and straightforward authentication bypass mechanism present moderate real-world risk.
RemediationAI
The primary remediation is to implement role-based access control (RBAC) on the '/logs' and '/logs-stream' endpoints by adding authorization checks (e.g., 'is_superuser' or equivalent privilege validation) to the endpoint dependencies. In FastAPI, this involves modifying the dependency chain from 'get_current_active_user' to a compound dependency such as 'get_current_admin_user' that verifies both authentication and administrative privilege before granting access. As an interim workaround pending code deployment, restrict network access to the log endpoints via reverse proxy rules, API gateway policies, or firewall rules to limit exposure to trusted administrator IP ranges only. Additionally, audit existing access logs to identify if low-privilege accounts have accessed '/logs' or '/logs-stream' endpoints, and rotate any credentials or secrets that may have been exposed. The vendor advisory reference (https://www.tenable.com/security/research/tra-2026-23) should be consulted for detailed patching guidance and any vendor-specific mitigation recommendations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from a missing authorization control (CWE-862: Missing Authorization) in a log router component that implements two HTTP endpoints for log retrieval. The endpoints rely exclusively on FastAPI's 'get_current_active_user' dependency, which verifies user authentication but performs no role-based access control (RBAC) or privilege validation (no 'is_superuser' or equivalent administrative check). The CVSS vector AV:N/AC:L/PR:L indicates the flaw is remotely exploitable over a network with low complexity once a valid authenticated credential is obtained. The affected technology appears to be a Python-based web application using FastAPI or similar framework, where authentication is decoupled from authorization, allowing vertical privilege escalation from standard user to log-reading capabilities normally reserved for administrators.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').
Executive ViewAI
CVE-2026-5025 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
GitHub PoC
Exploit-DB