CVE-2026-21445: 
Python vulnerability analysis and mitigation

CVE-2026-21445 is a missing authentication vulnerability in Langflow, an open-source platform for building and deploying AI-powered agents and workflows. Multiple critical API endpoints in the monitoring module lack authentication controls, allowing any unauthenticated remote user to access sensitive conversation data, transaction histories, and perform destructive operations such as message deletion. The vulnerability affects Langflow versions up to and including 1.7.0.dev44 (langflow package) and langflow-base up to 0.6.9; the patched versions are langflow 1.7.1 and langflow-base 0.7.1. It was disclosed on January 2, 2026, with a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.8 (High) (Github Advisory, Langflow Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): three API endpoints in src/backend/base/langflow/api/v1/monitor.py were defined without the FastAPI dependencies=[Depends(get_current_active_user)] authentication dependency that other endpoints in the same file correctly implement. The affected endpoints are GET /api/v1/monitor/messages, GET /api/v1/monitor/transactions, and DELETE /api/v1/monitor/messages/session/{session_id}. An attacker needs only network access to the Langflow server — no credentials, special privileges, or user interaction are required — and can exploit the flaw with simple HTTP requests (e.g., curl). A public PoC repository and reproduction steps were included in the original security advisory (Langflow Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to read all user conversation data and AI transaction histories stored in the Langflow instance, exposing potentially sensitive personal and proprietary information. Attackers can also permanently delete conversation histories for any session, causing irreversible data loss. The exposure creates compliance risks under GDPR and CCPA, and the harvested conversation data (which may include API keys, business logic, or personal details shared with AI agents) can facilitate further attacks or lateral movement within an organization (Langflow Advisory, Github Advisory).

A public proof-of-concept exploit is available on GitHub and was published within two days of disclosure (PoC Repo). The GitHub Advisory Database reports an EPSS score of approximately 9.015% (93rd percentile), indicating a significantly elevated probability of exploitation. CrowdSec published a vulnerability tracking report documenting exploitation activity (CrowdSec Report). Nuclei detection templates were also added to the ProjectDiscovery nuclei-templates repository, enabling automated scanning. As of the time of reporting, no specific threat actor attribution or CISA KEV catalog listing has been confirmed, though the CVSS v4.0 exploit maturity is rated as Proof-of-Concept (Github Advisory).

1. Reconnaissance: Identify internet-facing Langflow instances using tools like Shodan or Censys by searching for the default Langflow port (7860) or known HTTP response signatures. Confirm the version is ≤ 1.7.0.dev44 by checking the /api/v1/version endpoint or application UI.
2. Enumerate conversations: Send an unauthenticated GET request to retrieve all stored user conversations: curl http://<target>:7860/api/v1/monitor/messages. The server returns a JSON list of all message records without requiring any credentials.
3. Enumerate transaction histories: Send an unauthenticated GET request to retrieve transaction logs: curl "http://<target>:7860/api/v1/monitor/transactions?flow_id=<flow_uuid>". Flow UUIDs can be discovered from the messages response or by brute-forcing common UUID formats.
4. Perform destructive operations: Delete a target user's conversation history by sending an unauthenticated DELETE request: curl -X DELETE http://<target>:7860/api/v1/monitor/messages/session/<session_id>. The server returns HTTP 204 No Content on success.
5. Data harvesting / lateral movement: Scrape all conversation data for sensitive information (API keys, credentials, business logic, PII) embedded in AI agent interactions, and use gathered intelligence for further attacks against the organization (Langflow Advisory, Github Advisory).

• Network: Unauthenticated HTTP GET requests to /api/v1/monitor/messages or /api/v1/monitor/transactions from external or unexpected IP addresses; unauthenticated HTTP DELETE requests to /api/v1/monitor/messages/session/<session_id>; high-volume or automated requests to these endpoints suggesting scraping activity.
• Logs: Langflow access logs showing requests to the above endpoints without Authorization headers or API key parameters returning HTTP 200 or 204 responses; repeated requests from a single IP across multiple session IDs or flow UUIDs.
• Application Behavior: Unexpected disappearance of conversation histories or session records; sudden reduction in stored message counts without corresponding user-initiated deletions.
• Network Scanning: Inbound connections from known vulnerability scanner IPs or Nuclei-based scanners probing port 7860 with requests matching the affected endpoint paths (Langflow Advisory, CrowdSec Report).

The primary remediation is to upgrade Langflow to version 1.7.1 (or langflow-base to 0.7.1), which adds the dependencies=[Depends(get_current_active_user)] authentication requirement to all affected endpoints (Patch Commit, Github Advisory). As an interim workaround, implement network-level access controls (firewall rules, reverse proxy authentication, or VPN requirements) to restrict access to the Langflow API to authorized users only. After patching, conduct a review of API access logs to identify any unauthorized access or data exfiltration that may have occurred during the exposure window.

CrowdSec published a dedicated vulnerability tracking report documenting exploitation activity and providing detection guidance (CrowdSec Report). The vulnerability received coverage from Cyfirma's weekly intelligence report and was highlighted by security researchers on Bluesky and LinkedIn. ProjectDiscovery added Nuclei detection templates for automated scanning of this vulnerability, reflecting community interest in active detection. Check Point also published an advisory (CPAI-2026-0205) covering this CVE.