Executive brief
Langflow, a tool for building multi-agent AI applications, contains a security flaw in how it handles image downloads. An unauthorized person can download images uploaded by other users if they know or can guess the specific ID of a workflow. This could lead to the exposure of sensitive data or private images across different user accounts in shared environments.
Technical details
The `/api/v1/files/images/{flow_id}/{file_name}` endpoint in Langflow fails to implement authentication or ownership checks. While other file-related endpoints use the `Depends(get_flow)` dependency to enforce access control, the `download_image` function in `src/backend/base/langflow/api/v1/files.py` lacks this protection. An unauthenticated attacker can exploit this Insecure Direct Object Reference (IDOR) vulnerability by sending a GET request with a valid `flow_id` (UUID) and `file_name` to retrieve images. This is particularly critical in multi-tenant deployments where UUIDs might be leaked through other API responses. The issue is resolved in version 1.9.0.
Affected products
- langflow-ai langflow >= 1.0.0, < 1.9.0
Timeline
- 2026-03-20: disclosed
- 2026-03-20: advisory
- 2026-03-20: patched: Fixed in version 1.9.0