CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2026-21445

Langflow Unchained: Open Gates and Path Traversals in the AI Pipeline

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·153 visits

Executive Summary (TL;DR)

The Langflow dev team forgot to lock the front door. Critical API endpoints—including log streams and user creation—lacked authentication checks. Combined with a path traversal vulnerability in the profile picture handler, unauthenticated attackers could fully compromise the instance, steal OpenAI/Anthropic keys, and exfiltrate server files.

Langflow, a popular visual framework for building AI agents, shipped with critical endpoints completely exposed to unauthenticated users. This vulnerability allowed attackers to stream live application logs (leaking API keys), create administrative users, and read arbitrary files via directory traversal.

Official Patches

LangflowGitHub Commit fixing the vulnerabilities

Fix Analysis (1)

Technical Appendix

CVSS Score
8.8/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Affected Systems

Langflow AI Agent Builder

Affected Versions Detail

Product
Affected Versions
Fixed Version
Langflow
langflow-ai
< 1.7.0.dev451.7.0.dev45
AttributeDetail
CWE IDCWE-306 (Missing Authentication)
Secondary CWECWE-22 (Path Traversal)
CVSS v4.08.8 (High)
Attack VectorNetwork
Privileges RequiredNone
ImpactCritical (Data Leakage, RCE potential)

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1078Valid Accounts
Defense Evasion
T1005Data from Local System
Collection
CWE-306
Missing Authentication for Critical Function

The software does not prove that a claim of identity is correct when that claim is used to execute a critical function.

Known Exploits & Detection

Manual AnalysisDirect API manipulation via curl allows admin creation and log streaming.
NucleiDetection Template Available

Vulnerability Timeline

Vulnerability Published and Patched
2026-01-02

References & Sources

  • [1]GHSA-c5cp-vx83-jhqx Advisory
  • [2]NVD Entry

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•12 minutes ago•CVE-2026-88983
5.0

CVE-2026-88983: Authenticated Server-Side Request Forgery in Kubeflow Pipelines API Server

CVE-2026-88983 is an authenticated Server-Side Request Forgery (SSRF) vulnerability affecting the Kubeflow Pipelines API server in versions prior to 2.17.0. When an authenticated user creates a pipeline or pipeline version using a remote specification URI, the backend server retrieves the document via Go's default HTTP client without validating the target scheme, hostname, port, or IP address. Because the API server reflects remote connection errors and HTTP status codes in its response, an attacker with pipeline creation permissions can exploit the server as a status-code and port-scanning oracle against Kubernetes cluster-internal services, private networks, and cloud metadata endpoints.

Amit Schendel
Amit Schendel
1 views•11 min read
•about 1 hour ago•CVE-2026-88985
6.5

CVE-2026-88985: SQL Injection via Pagination Token Deserialization and Metric Sorting in Kubeflow Pipelines API Server

CVE-2026-88985 is a SQL injection vulnerability (CWE-89) in the Kubeflow Pipelines (KFP) API server prior to version 2.17.0. The flaw stems from the untrusted deserialization of base64-encoded JSON pagination tokens (page_token) and the direct concatenation of metric names during run list sorting. Authenticated users with permissions to invoke REST or gRPC list endpoints can inject arbitrary SQL syntax into structural query identifiers and JOIN predicates, enabling unauthorized cross-tenant read access to all database records accessible by the API server.

Alon Barad
Alon Barad
2 views•10 min read
•about 2 hours ago•CVE-2026-88986
6.1

CVE-2026-88986: Reflected Cross-Site Scripting in Kubeflow Pipelines Frontend Error Responses

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Kubeflow Pipelines frontend server prior to version 2.15.0. Specifically, the Express route handlers for '/pipeline/k8s/pod' and '/pipeline/k8s/pod/events' reflect unvalidated 'podname' and 'podnamespace' query parameters, along with backend Kubernetes API error messages, directly into HTML-capable HTTP error responses. An unauthenticated attacker can exploit this flaw by convincing an authenticated user to visit a crafted URL, resulting in arbitrary JavaScript execution within the context of the Kubeflow Pipelines frontend origin.

Alon Barad
Alon Barad
4 views•10 min read
•about 3 hours ago•CVE-2026-88984
7.2

CVE-2026-88984: RBAC Authorization Bypass in Kubeflow Pipelines Multi-User API Server

CVE-2026-88984 (GHSA-ghgh-57qv-h687) is an incorrect authorization vulnerability affecting Kubeflow Pipelines (KFP) prior to version 2.16.1 in multi-user deployments. The multi-user API server treats the empty Kubernetes namespace associated with shared or global pipelines as an unconditional authorization exception across all API verbs. Consequently, any authenticated user can modify, overwrite, or delete shared pipeline definitions and pipeline versions without possessing the required Kubernetes RBAC permissions, compromising the integrity and availability of global machine learning workflows.

Amit Schendel
Amit Schendel
5 views•10 min read
•about 4 hours ago•CVE-2026-102340
8.5

CVE-2026-102340: Missing Authentication and Authorization in Telepresence Traffic Manager gRPC API

Prior to version 2.31.0, the Telepresence Traffic Manager exposed an unauthenticated gRPC API on cluster-internal port 8081 that lacked caller identity verification and Kubernetes RBAC authorization checks. An attacker operating any pod with network access to the Traffic Manager can register a session in an arbitrary managed namespace, establish service intercepts, redirect live production traffic, and exfiltrate the complete container environment of victim workloads, including mounted secrets and service account tokens.

Amit Schendel
Amit Schendel
5 views•10 min read
•about 5 hours ago•CVE-2026-63198
7.3

CVE-2026-63198: OAuth 2.0 Silent Authorization Scope Escalation in traQ

CVE-2026-63198 (GHSA-8cfq-jgf7-8m27) is an incorrect authorization vulnerability (CWE-863) in traQ, an open-source messaging platform developed in Go by Digital Creators Club traP. The flaw resides in the OAuth 2.0 authorization endpoint handler (`router/oauth2/authorization_endpoint.go`). When processing silent authorization requests (`prompt=none`) with an omitted or empty `scope` parameter, the application evaluates prior user consent against the empty requested scope set prior to applying default scope fallback logic. Because an empty set vacuously satisfies the subset check against any existing token, consent verification succeeds if the user has ever authorized the client for any single scope. Subsequently, the token issuance logic defaults the empty scope parameter to all scopes registered to the client (`req.ValidScopes`), allowing a client application with partial consent to silently escalate privileges without user interaction.

Alon Barad
Alon Barad
4 views•9 min read