Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-5025 EUVD-2026-16664

Langflow - Application Logs Exposed to All Authenticated Users

Published Mar 27, 2026 · Updated Mar 27, 2026 · Assigned by tenable

Description

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').

Affected products

VendorProductAffectedFixed
langflow-ai langflow — —

Advisories 1

References