Summary
Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
Product
Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.
Vulnerabilities 2
-
High 8.8
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts,…
-
Medium 6.5
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used …
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-38519, EUVD-2026-38518
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-9c59-2mvc-vfr8 vom 2026-06-11
https://github.com/langflow-ai/langflow/security/advisories/GHSA-9c59-2mvc-vfr8
-
GitHub Security Advisory GHSA-79ph-745m-6wxq vom 2026-06-11
https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq