Executive brief
Langflow is a platform used to build and deploy AI-powered agents and workflows. A security flaw allowed any logged-in user to view, modify, or delete the AI workflows created by other users. This could lead to the exposure of sensitive information like API keys, unauthorized changes to AI logic, or the deletion of critical business processes.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability existed in the `_read_flow` helper function within `src/backend/base/langflow/api/v1/flows.py`. The application branched on the `AUTO_LOGIN` setting but failed to enforce a `user_id` ownership filter when authentication was enabled (`AUTO_LOGIN=False`). Because the GET, PATCH, and DELETE endpoints for flows all rely on this helper, an authenticated attacker could provide a target flow's UUID to bypass authorization. This allowed for the extraction of plaintext API keys embedded in flows, modification of agent logic, or deletion of flows. The issue was resolved in version 1.5.1 by removing the conditional logic and strictly scoping database queries to the requesting user's ID.
Affected products
- Langflow AI Langflow < 1.5.1
- Langflow AI langflow-base <= 0.5.0
Timeline
- 2025-07-09: patched: Pull request merged to fix flow retrieval logic.
- 2026-03-25: advisory: Vendor security advisory published.
- 2026-03-27: disclosed: CVE-2026-34046 published.