Authorization Flaw in Langflow Affects Multiple Versions
CVE-2026-105698
5.4MEDIUM
What is CVE-2026-105698?
Langflow, a tool designed for creating AI-driven agents and workflows, has a significant authorization flaw affecting various versions up to 1.10.1. This vulnerability allows an unauthenticated user with knowledge of another user's flow UUID to access unauthorized flow operations via certain API endpoints. Affected users could potentially retrieve and cache sensitive graph structures, including flow configurations and output values, posing a risk of unintended exposure of private information and executing selected vertices without proper authorization. This issue has been addressed in version 1.10.1.
Affected Version(s)
langflow >= 1.0.0, < 1.10.1
langflow-base < 0.10.1