Insecure API Access in Langflow Tool by Langflow AI
CVE-2026-34046

8.7HIGH

Key Information:

Vendor

Langflow-ai

Status
Langflow
Langflow-base
Vendor
CVE Published:
27 March 2026

What is CVE-2026-34046?

The Langflow tool, used for creating AI-powered agents and workflows, has a vulnerability in its API where the _read_flow method does not properly enforce ownership checks. Specifically, when the AUTO_LOGIN setting is disabled, authenticated users can access flows belonging to other users without any ownership validation, potentially exposing sensitive data such as plaintext API keys. This vulnerability arises from flawed conditional logic that inadvertently left paths without restrictions for authenticated access. In version 1.5.1, the developers addressed this issue by ensuring that all queries are scoped to the requesting user's ownership, thus mitigating the security risk.

Affected Version(s)

langflow < 1.5.1

langflow-base < 0.5.1

References

https://github.com/langflow-ai/langflow/security/advisori...
x_refsource_CONFIRM
https://github.com/langflow-ai/langflow/pull/8956
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.