CVE-2026-34046: 
Python vulnerability analysis and mitigation

CVE-2026-34046 is an Insecure Direct Object Reference (IDOR) / missing authorization vulnerability in Langflow, a tool for building and deploying AI-powered agents and workflows. The flaw resides in the _read_flow helper function in src/backend/base/langflow/api/v1/flows.py, which fails to enforce ownership checks when authentication (AUTO_LOGIN = False) is enabled, allowing any authenticated user to read, modify, or delete flows belonging to other users. Affected versions include langflow <= 1.5.0 and langflow-base <= 0.5.0; the vulnerability was disclosed on March 25, 2026, and patched in version 1.5.1. It carries a CVSS v4 base score of 8.7 (High) and a CVSS v3.1 base score of 8.8 (High) (Github Advisory, Langflow Security Advisory).

The root cause is a flawed conditional in the _read_flow helper that branched on the AUTO_LOGIN setting to determine whether to filter database queries by user_id. When AUTO_LOGIN was False (authentication enabled), neither branch of the conditional applied an ownership filter — the SQLAlchemy query returned any Flow record matching the supplied UUID regardless of the requesting user's identity. This is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The attack vector is network-based, requires only low privileges (a valid authenticated session), and no user interaction, making it straightforward to exploit by supplying arbitrary flow UUIDs to the GET, PATCH, and DELETE endpoints at /api/v1/flow/{flow_id} (Github Advisory, Fix PR #8956).

Successful exploitation allows any authenticated user to read any other user's flows — including embedded plaintext API keys stored within flow definitions — modify the logic of another user's AI agents, and permanently delete flows they do not own. This creates high confidentiality, integrity, and availability impacts scoped to the vulnerable Langflow instance. Exposed API keys could enable lateral movement to third-party services (e.g., LLM providers, databases) integrated into the compromised flows (Github Advisory, Langflow Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability was responsibly disclosed by security researcher @chximn-dt. The EPSS score is approximately 0.052% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low exploitation complexity — requiring only a valid authenticated account and knowledge of a target flow's UUID — makes it a realistic threat in multi-tenant or shared Langflow deployments.

1. Obtain authentication: Register or log in to the target Langflow instance with any valid user account (e.g., a free trial or low-privilege account).
2. Enumerate flow UUIDs: Use the authenticated session to call GET /api/v1/flows/ to list flows visible to the attacker's account, or enumerate UUIDs through other means (e.g., shared links, logs, or brute-force of UUID space).
3. Access another user's flow: Send a GET /api/v1/flow/{target_flow_id} request using the attacker's authentication token but substituting a UUID belonging to another user. Due to the missing ownership check, the server returns the full flow definition including any embedded plaintext API keys.
4. Modify another user's flow: Send a PATCH /api/v1/flow/{target_flow_id} request with a modified flow payload to alter the AI agent logic (e.g., inject malicious nodes or redirect data exfiltration).
5. Delete another user's flow: Send a DELETE /api/v1/flow/{target_flow_id} request to permanently remove the target flow, causing denial of service for the flow owner.
6. Leverage exposed API keys: Extract plaintext API keys from the retrieved flow definitions and use them to access integrated third-party services (e.g., OpenAI, databases) for further lateral movement (Github Advisory, Fix PR #8956).

• Network: Unusual GET, PATCH, or DELETE requests to /api/v1/flow/{flow_id} from a user account that does not own the referenced flow UUID; high-frequency enumeration of flow UUIDs from a single authenticated session.
• Logs: Langflow API access logs showing a single user account accessing flow IDs associated with multiple different owners; HTTP 200 responses to flow read/modify/delete requests for flows not created by the requesting user.
• Behavioral: Unexpected modifications to AI agent flow logic (e.g., new nodes, changed configurations) not initiated by the flow owner; flows disappearing without owner-initiated deletion; third-party API keys (e.g., OpenAI, Anthropic) showing unexpected usage spikes or access from unfamiliar IPs after a Langflow instance was accessed.

Upgrade Langflow to version 1.5.1 (or langflow-base to 0.5.1), which removes the AUTO_LOGIN conditional entirely and unconditionally scopes all flow queries to the requesting user's user_id. No configuration-based workaround is available for unpatched versions. After upgrading, administrators should audit access logs to identify unauthorized flow access, review and rotate any API keys embedded in flows that may have been exposed, and implement network segmentation and access controls to limit which users can authenticate to the Langflow instance (Github Advisory, Fix PR #8956).

The vulnerability was responsibly disclosed by security researcher @chximn-dt and acknowledged by Langflow maintainer AntonioABLima in the official GitHub Security Advisory. The fix was reviewed and merged by jordanrfrazier on July 9, 2025. Community discussion was noted in a related GitHub issue (#12380) filed after the advisory was published. No significant broader media coverage or notable social media reactions beyond standard CVE tracking feeds have been identified (Langflow Security Advisory, Fix PR #8956).