CVE-2026-33484: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33484 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in Langflow, a tool for building and deploying AI-powered agents and workflows. The /api/v1/files/images/{flow_id}/{file_name} endpoint serves image files without any authentication or ownership verification, allowing any unauthenticated attacker to download arbitrary user-uploaded images. Affected versions span 1.0.0 through 1.8.1 (inclusive); version 1.9.0 contains the patch. The vulnerability was published on March 20, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Langflow Advisory).

The root cause is a missing authorization check (CWE-862 / CWE-284 / CWE-639) in src/backend/base/langflow/api/v1/files.py (lines 138–164), where the download_image function accepts flow_id as a bare UUID path parameter without invoking Depends(get_flow) or CurrentActiveUser — the dependency injections used by all other file-related endpoints (download_file, upload_file, list_files, delete_file) to enforce authentication and ownership. Because there is no global authentication middleware on the /api/v1 prefix, protection is applied per-endpoint only, leaving this route entirely unguarded. An attacker needs only a valid flow_id (UUID) and file_name, both of which can be leaked or inferred from other API responses, to retrieve image files via a simple unauthenticated HTTP GET request (GitHub Advisory, Langflow Advisory).

Successful exploitation results in unauthorized disclosure of user-uploaded image files across tenant boundaries, constituting a high-confidentiality-impact breach with no effect on integrity or availability. In multi-tenant Langflow deployments, an attacker can systematically harvest images belonging to any user without credentials or user interaction, potentially exposing sensitive business data, proprietary diagrams, or personally identifiable information embedded in uploaded images. The attack is fully network-accessible, requires no privileges, and can be conducted at scale against any discoverable flow (GitHub Advisory).

The advisory includes a concrete proof-of-concept curl command demonstrating unauthenticated image retrieval, classified as a high-confidence exploit by Feedly threat intelligence. As of the advisory publication, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.017% (16th percentile), indicating a currently low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA KEV catalog at this time (GitHub Advisory, Langflow Advisory).

1. Reconnaissance: Identify internet-facing Langflow instances running versions 1.0.0–1.8.1 using tools like Shodan or Censys, searching for the default port 7860 or known Langflow UI signatures.
2. Obtain flow_id: Interact with other Langflow API endpoints (e.g., flow listing or public API responses) that leak or expose flow_id UUIDs, or attempt UUID enumeration/brute-force if the attack surface is limited.
3. Identify file names: Determine image file names associated with the target flow through API responses, error messages, or educated guessing of common naming conventions.
4. Send unauthenticated request: Issue a plain HTTP GET request to the vulnerable endpoint without any authentication header:

   curl -v "http://<target>:7860/api/v1/files/images/<flow_uuid>/<filename.png>"

5. Retrieve image: The server responds with HTTP 200 and returns the image file bytes, completing the unauthorized cross-tenant data exfiltration with no credentials required (GitHub Advisory, Langflow Advisory).

• Network: Repeated unauthenticated HTTP GET requests to /api/v1/files/images/<uuid>/<filename> returning HTTP 200, especially from external or unexpected IP addresses; high-volume requests to this endpoint pattern suggesting enumeration.
• Logs: Web server or application access logs showing requests to /api/v1/files/images/ with no Authorization header and HTTP 200 responses; sequential or randomized UUID patterns in the flow_id path segment indicating enumeration attempts.
• Behavioral: Requests to the image endpoint from IPs that have not previously authenticated to any other Langflow API endpoint; unusual spikes in outbound data transfer volume correlating with image endpoint access (GitHub Advisory).

Upgrade Langflow to version 1.9.0 or later, which patches the missing authorization check on the image download endpoint. For deployments that cannot be immediately upgraded, implement network-level access controls (e.g., firewall rules or reverse proxy authentication) to restrict access to the /api/v1/files/images/ path to authenticated users only. Additionally, review access logs for the affected endpoint to identify any prior unauthorized access, and rotate or invalidate flow UUIDs if feasible (GitHub Advisory, Langflow Advisory).

Heise reported on malicious code attacks targeting the Langflow AI tool, urging users to patch promptly (Heise). The vulnerability was also picked up by community security feeds and vulnerability tracking platforms shortly after disclosure, reflecting moderate interest in the AI tooling security space. No major vendor statements beyond the official GitHub advisory have been identified.