Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2026-21445

Good to know:

icon
icon
icon

Date: January 2, 2026

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2026-21445
https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
https://github.com/langflow-ai/langflow/releases/tag/1.5.1
https://github.com/langflow-ai/langflow/releases/tag/1.7.1
https://github.com/langflow-ai/langflow
https://www.mend.io/vulnerability-database/CVE-2026-21445

Severity Score

Weakness Type (CWE)

Missing Authentication for Critical Function

CWE-306

Top Fix

icon

Upgrade Version

Upgrade to version langflow-base - 0.7.1;langflow - 1.7.1;https://github.com/langflow-ai/langflow.git - v1.7.0.dev45

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us