Description
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| langflow-ai | langflow | — | — |
Advisories 1
- WID-SEC-2026-0900 Langflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 10, 2026