What’s Vulnerable › Vulnerabilities

CVE-2026-21445: Langflow Missing Authentication on Critical API Endpoints

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 33.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-02 · updated 2026-06-17
• Weakness: CWE-306

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

Affected products

• IBM Langflow OSS: before 1.7.1 — fixed in 1.7.1

How to fix

Upgrade to a fixed version: IBM Langflow OSS 1.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx

Get alerted when CVE-2026-21445 or the next vulnerability affects your stack