VulnerabilityAnalyzed

CVE-2026-21445

Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls.

HIGH 8.8EPSS 33.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 33.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

CVSS 4.0: 8.8 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 33.71% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: langflow/langflow
Source: security-advisories@github.com

References

https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486aPatch
https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqxExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.