{"data":{"id":"82e82402-304a-4c9a-8756-ce4055766e62","title":"CVE-2026-21445: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple…","summary":"Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow, a tool for building and deploying AI-powered agents and workflows, lack authentication controls. Any unauthenticated user can read sensitive user conversation data and transaction histories and delete messages, including through endpoints that handle personal data and system operations.","solution":"Version 1.7.0.dev45 contains a patch.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-21445","publishedAt":"2026-01-03T01:16:17.880Z","cveId":"CVE-2026-21445","cweIds":["CWE-306"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow-base@<= 0.6.9 (fixed: 0.7.1)","langflow@<= 1.7.0.dev44 (fixed: 1.7.1)"],"affectedPackageNames":["langflow-base","langflow"],"affectedPackageRefs":["pypi:langflow-base","pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow missing authentication on API endpoints exposes user data","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.33289,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-c5cp-vx83-jhqx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:29.599Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-12-19T22:49:36.722Z","daysToFix":-15,"fixCheckedAt":"2026-10-29T21:42:11.264Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.7.1","matchedVersion":"1.7.1","fixReleasedAt":"2025-12-19T22:49:50.879Z","daysToFix":-15,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:42:11.115Z"},{"ecosystem":"pypi","name":"langflow-base","fixedVersion":"0.7.1","matchedVersion":"0.7.1","fixReleasedAt":"2025-12-19T22:49:36.722Z","daysToFix":-15,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:42:11.115Z"}]}}