{"data":{"id":"6346f206-473e-4c67-8a75-1fd8254bdb89","title":"CVE-2026-6598: A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function…","summary":"A vulnerability in langflow-ai langflow up to 1.8.3 affects the function create_project/encrypt_auth_settings in src/backend/base/Langflow/api/v1/projects.py, part of the Project Creation Endpoint. Manipulating the auth_settings argument leads to cleartext storage in a file or on disk. The attack can be launched remotely, and a public exploit has been disclosed and may be used. The vendor was contacted early but did not respond.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6598","publishedAt":"2026-04-20T04:16:52.857Z","cveId":"CVE-2026-6598","cweIds":["CWE-312","CWE-313"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@< 1.9.1 (fixed: 1.9.1)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow cleartext storage of auth settings in project creation","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00242,"epssCheckedAt":"2026-10-15T00:11:29.175Z","kevDateAdded":null,"advisoryAliases":["GHSA-9jpj-cph8-w449"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:26.023Z","patchAvailable":true,"disclosureDate":"2026-04-20T04:16:52.857Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}