{"data":{"id":"9b32743c-4295-4984-b636-1022b0899849","title":"CVE-2026-6597: A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function…","summary":"CVE-2026-6597 is a weakness in langflow-ai langflow up to 1.8.3, located in the function remove_api_keys/has_api_terms in src/backend/base/langflow/api/utils/core.py, within the component Flow Using API. The flaw causes unprotected storage of credentials and can be initiated remotely. A public exploit is available, and the vendor did not respond to early disclosure contact.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6597","publishedAt":"2026-04-20T03:16:17.153Z","cveId":"CVE-2026-6597","cweIds":["CWE-255","CWE-256"],"cvssScore":"2.7","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.8.3"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow stores API credentials unprotected in Flow Using API component","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"high","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00377,"epssCheckedAt":"2026-10-14T12:12:42.913Z","kevDateAdded":null,"advisoryAliases":["GHSA-5jjf-wcvf-923w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:26.573Z","patchAvailable":null,"disclosureDate":"2026-04-20T03:16:17.153Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}