CVE-2026-21445

Katalog CVE

CVSS 9.1 · Critical EPSS 33,3%

Kerentanan Missing Authentication for Critical Function pada langflow. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

Rincian

Terbit di NVD

2 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

33,3% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx exploit · advisory vendor
• https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a patch