# CVE-2026-33484: Langflow unauthenticated IDOR in image download endpoint

Source: https://junglewise.ai/threats/cve-2026-33484-langflow-unauthenticated-idor-in-image-download-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-20. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-33484 · Severity: high · CVSS 7.5 · Published 2026-03-20

Langflow, a tool for building multi-agent AI applications, contains a security flaw in how it handles image downloads. An unauthorized person can download images uploaded by other users if they know or can guess the specific ID of a workflow. This could lead to the exposure of sensitive data or private images across different user accounts in shared environments.

Technologies: [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33484 being exploited in the wild.

**How severe is CVE-2026-33484?** High severity, with a CVSS score of 7.5, published 20 March 2026.

**Which products and versions are affected?** langflow (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=1.9.0.

**Is there a fix for CVE-2026-33484?** Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33484 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33484?** Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.9.0 or later

  ```sh
  pip install "langflow>=1.9.0"
  ```


## Technical details

The `/api/v1/files/images/{flow_id}/{file_name}` endpoint in Langflow fails to implement authentication or ownership checks. While other file-related endpoints use the `Depends(get_flow)` dependency to enforce access control, the `download_image` function in `src/backend/base/langflow/api/v1/files.py` lacks this protection. An unauthenticated attacker can exploit this Insecure Direct Object Reference (IDOR) vulnerability by sending a GET request with a valid `flow_id` (UUID) and `file_name` to retrieve images. This is particularly critical in multi-tenant deployments where UUIDs might be leaked through other API responses. The issue is resolved in version 1.9.0.

## Affected products

- langflow-ai langflow >= 1.0.0, < 1.9.0

## Identifiers

- CVE-2026-33484
- GHSA-7grx-3xcx-2xv5
- PYSEC-2026-80

## Timeline

- 2026-03-20: disclosed
- 2026-03-20: advisory
- 2026-03-20: patched: Fixed in version 1.9.0

## References

- [https://api.github.com/users/akshatgit](https://api.github.com/users/akshatgit)
- [https://github.com/akshatgit](https://github.com/akshatgit)
- [https://api.github.com/users/akshatgit/gists%7B/gist_id%7D](https://api.github.com/users/akshatgit/gists%7B/gist_id%7D)
- [https://api.github.com/users/akshatgit/repos](https://api.github.com/users/akshatgit/repos)
- [https://avatars.githubusercontent.com/u/11229971?v=4](https://avatars.githubusercontent.com/u/11229971?v=4)
- [https://api.github.com/users/akshatgit/events%7B/privacy%7D](https://api.github.com/users/akshatgit/events%7B/privacy%7D)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)