Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6y1z-b2ye-jkd6
Vulnerability ID VCID-6y1z-b2ye-jkd6
Aliases CVE-2026-21445
GHSA-c5cp-vx83-jhqx
Summary Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-306 Missing Authentication for Critical Function
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.07998 https://api.first.org/data/v1/epss?cve=CVE-2026-21445
epss 0.09015 https://api.first.org/data/v1/epss?cve=CVE-2026-21445
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-c5cp-vx83-jhqx
cvssv4 8.8 https://github.com/langflow-ai/langflow
generic_textual HIGH https://github.com/langflow-ai/langflow
cvssv4 8.8 https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
generic_textual HIGH https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
ssvc Track https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
cvssv4 8.8 https://github.com/langflow-ai/langflow/releases/tag/1.7.1
generic_textual HIGH https://github.com/langflow-ai/langflow/releases/tag/1.7.1
cvssv3.1_qr HIGH https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
cvssv4 8.8 https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
generic_textual HIGH https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
ssvc Track https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
cvssv4 8.8 https://nvd.nist.gov/vuln/detail/CVE-2026-21445
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-21445
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-21445
https://github.com/langflow-ai/langflow/releases/tag/1.7.1
3fed9fe1b5658f2c8656dbd73508e113a96e486a https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
CVE-2026-21445 https://nvd.nist.gov/vuln/detail/CVE-2026-21445
GHSA-c5cp-vx83-jhqx https://github.com/advisories/GHSA-c5cp-vx83-jhqx
GHSA-c5cp-vx83-jhqx https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/langflow-ai/langflow
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-01-06T04:55:18Z/ Found at https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/langflow-ai/langflow/releases/tag/1.7.1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-01-06T04:55:18Z/ Found at https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2026-21445
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.92308
EPSS Score 0.07998
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:47:09.698910+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/21xxx/CVE-2026-21445.json 38.6.0