CVE-2026-21445
Critical · 9.1Langflow Missing Authentication on Critical API Endpoints
CVSS
9.1
EPSS
33.3%
Published
Jan 2, 2026
CISA due date
—
The record
Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | langflow | 0 | 1.7.1 |
| PyPI | langflow-base | 0 | 0.7.1 |
Related vulnerabilities
- GHSA-c5cp-vx83-jhqx Langflow Missing Authentication on Critical API Endpoints Same vulnerability
- GHSA-3645-fxcv-hqr4 Langflow has Remote Code Execution in CSV Agent Also affects langflow
- CVE-2026-27966 Langflow is a tool for building and deploying AI-powered agents and workflows. Also affects langflow
- GHSA-g22f-v6f7-2hrh Langflow affected by Remote Code Execution via validate_code() exec() Also affects langflow
- CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… Also affects langflow
- GHSA-f43r-cc68-gpx4 External Control of File Name or Path in Langflow Also affects langflow
- GHSA-5993-7p27-66g5 Langflow vulnerable to Server-Side Request Forgery Also affects langflow
- CVE-2025-68477 Langflow vulnerable to Server-Side Request Forgery Also affects langflow