Skip to content
OpenAdvisories
Medium WID-SEC-2026-1178 5 CVEs

Langflow: Mehrere Schwachstellen

Published Apr 19, 2026 · Updated Apr 19, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 5

  • High 7.3
    CVE-2026-6596

    langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload

    A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted uploa…

    langflow-ai langflow langflow-base PyPI
  • Medium 6.3
    CVE-2026-6599

    langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection

    A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get_client_ip/install_mcp_config of the file src/backend/base/langflow/api/v1/mcp_projects.py of the component Model Context Protocol Configuration API. Per…

    langflow-ai langflow langflow PyPI
  • Medium 4.3
    CVE-2026-6598

    langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file

    A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such…

    langflow-ai langflow langflow PyPI
  • Low 3.5
    CVE-2026-6600

    langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting

    A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/chatMessage/components/edit-message.tsx of the component Frontend React Component Rendering. Executing …

    langflow-ai langflow
  • Low 2.7
    CVE-2026-6597

    langflow-ai langflow Flow Using API core.py has_api_terms credentials storage

    A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of…

    langflow-ai langflow langflow PyPI

Revision history

  1. #1

    Initiale Fassung

References