GHSA-8c4j-f57c-35cf: Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Summary

Langflow's `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` omitted an ownership check when `AUTO_LOGIN` was `False`, so any authenticated user could read, modify, or delete another user's flow via `GET/PATCH/DELETE /api/v1/flow/{flow_id}`. Exposed data included embedded plaintext API keys, and attackers could alter other users' AI agent logic. The flaw was introduced by conditional logic meant to support public example flows (`user_id = NULL`) under auto-login mode.

Mitigation

Fixed in PR #8956, which removes the `AUTO_LOGIN` conditional and unconditionally scopes the query to the requesting user with `Flow.user_id == user_id`. A cross-user isolation test, `test_read_flows_user_isolation`, was added to prevent regression.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langflowPyPIReaches an LLM package through dependencies
• langflow-basePyPILLM dependency since 2024-04-01 · 1 tracked dependent

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News