Vulnerability in langflow (CVE-2026-34046)
Summary
Vulnerability in langflow (CVE-2026-34046). Successful exploitation can lead to full system takeover. Exploitable via DELETE /api/v1/flow/{flow_id}. Mitigation: upgrade to 1.5.1 or later.
Original description
The description as published by the source.
Vulnerability
IDOR in GET/PATCH/DELETE /api/v1/flow/{flow_id}
The _read_flow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTO_LOGIN setting to decide whether to filter by user_id. When AUTO_LOGIN was False (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it.
This exposed any authenticated user to:
- Read any other user's flow, including embedded plaintext API keys
- Modify the logic of another user's AI agents
- Delete flows belonging to other users
The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with user_id = NULL) under auto-login mode, but inadvertently left the authenticated path without an ownership filter.
Fix (PR #8956)
The fix removes the AUTO_LOGIN conditional entirely and unconditionally scopes the query to the requesting user:
- auth_settings = settings_service.auth_settings
- stmt = select(Flow).where(Flow.id == flow_id)
- if auth_settings.AUTO_LOGIN:
- stmt = stmt.where(
- (Flow.user_id == user_id) | (Flow.user_id == None) # noqa: E711
- )
+ stmt = select(Flow).where(Flow.id == flow_id).where(Flow.user_id == user_id)
All three operations — read, update, and delete — route through _read_flow, so the single change covers the full attack surface. A cross-user isola…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-34046 has been found in langflow.
Attackers can target a specific entry point like DELETE /api/v1/flow/{flow_id} over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 8.8/10.
What to do: upgrade langflow to 1.5.1 or later.
If unsure, ask your IT team or search "langflow CVE-2026-34046" on the vendor's site.
CVE-2026-34046 (langflow) — CWE-639 / CVSS v3 8.8
Attack vector: remote (network-reachable) / no user interaction
Attack surface: DELETE /api/v1/flow/{flow_id} / _read_flow / AUTO_LOGIN / user_id
Patched: 1.5.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-639) exists in langflow. Attackers reach the vulnerable code path via DELETE /api/v1/flow/{flow_id}.
Check the vendor advisory for the affected versions of langflow. Attack surface: DELETE /api/v1/flow/{flow_id} / _read_flow / AUTO_LOGIN / user_id.
Severity: High (CVSS 8.8/10). Successful exploitation can lead to full system takeover.
Update to 1.5.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual DELETE /api/v1/flow/{flow_id} requests with malformed payloads or SQL meta-characters. Run grep -r 'langflow' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'langflow' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
langflowを grep し、稼働しているサービス・バージョンを把握する。 -
2Hunt for indicators of compromise detect
grep 'DELETE /api/v1/flow/{flow_id}' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
DELETE /api/v1/flow/{flow_id}への異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
3Apply patch patch
Upgrade langflow to 1.5.1ステージング環境で 1.5.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 2 で見つけた異常検知の続報チェックを含めること。
-
4Post-deployment verification verify
Replay attack against DELETE /api/v1/flow/{flow_id} on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com