{"id":"CVE-2026-34046","published":"2026-03-27T20:06:35Z","modified":"2026-04-01T03:55:31Z","title":"Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check","vendor":"langflow-ai","product":"langflow","tier":"tail","description":{"text":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00477,"percentile":0.41049,"provenance":"source"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/langflow-ai/langflow/pull/8956","tags":["x_refsource_MISC"]}],"priority":{"score":14.3,"factors":[{"name":"EPSS percentile","points":8.21},{"name":"CVSS severity","points":6.09}]},"vendorSlug":"langflow-ai","affectedVersions":[{"vendor":"langflow-ai","product":"langflow","versions":["< 1.5.1"]},{"vendor":"langflow-ai","product":"langflow-base","versions":["< 0.5.1"]}],"affected":[{"ecosystem":"PyPI","package":"langflow","vulnerableRanges":["<1.5.1"],"patched":["1.5.1"],"from":["GHSA-8c4j-f57c-35cf","PYSEC-2026-2567"],"provenance":"source"},{"ecosystem":"PyPI","package":"langflow-base","vulnerableRanges":["<0.5.1"],"patched":["0.5.1"],"from":["GHSA-8c4j-f57c-35cf","PYSEC-2026-2570"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-16850","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-55446","published":"2026-06-23","fixed":"1.0.19","kev":false},{"cve":"CVE-2025-3248","published":"2025-04-07","fixed":"1.3.0","kev":true},{"cve":"CVE-2025-57760","published":"2025-08-25","fixed":"1.5.1","kev":false,"link":{"from":"CVE-2025-57760","to":"CVE-2026-34046","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:langflow","fromFixed":"1.5.0","toFixed":"1.5.1","daysApart":214}]}},{"cve":"CVE-2026-34046","published":"2026-03-27","fixed":"1.5.1","kev":false},{"cve":"CVE-2025-34291","published":"2025-12-05","fixed":"1.7.0","kev":true},{"cve":"CVE-2026-55423","published":"2026-06-23","fixed":"1.7.0","kev":false,"link":{"from":"CVE-2026-34046","to":"CVE-2026-55423","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:langflow","fromFixed":"1.5.1","toFixed":"1.7.0","daysApart":88}]}},{"cve":"CVE-2025-68477","published":"2025-12-19","fixed":"1.7.1","kev":false}],"package":"PyPI:langflow"}}