CVE-2026-21445: Critical Langflow API Exposure Allows Unauthenticated Access to Conversations, Transactions, and Data Deletion

CVE ID: CVE-2026-21445
Product: Langflow
Vulnerability Type: Missing Authentication / Broken Access Control
Affected Versions: All versions prior to 1.7.0.dev45
Fixed Version: 1.7.0.dev45
Attack Vector: Network (Remote)
Authentication Required: None
User Interaction: None

Severity & Risk

CVSS v3.1 Score: 9.8 (Critical)
Severity: Critical
Exploitability: Very High
Exploit Maturity: Easily weaponized (basic HTTP requests)
Impact Scope: Confidentiality, Integrity, Availability
Attack Complexity: Low

Executive Summary

CVE-2026-21445 is a critical access control failure in Langflow that exposes internal API endpoints to unauthenticated users. These APIs allow direct interaction with sensitive backend functionality, including user conversations, messages, transaction logs, and workflow operations.

The absence of authentication checks means anyone with network access to the Langflow service can retrieve sensitive data or perform destructive actions. This vulnerability is especially dangerous because Langflow is often deployed in development, staging, and internal environments that are mistakenly assumed to be trusted.

Why This Vulnerability Matters

Langflow frequently handles:

Proprietary prompts
Internal workflows
Customer conversations
AI-generated outputs tied to business logic

Exposure of this data can:

Leak intellectual property
Expose personal or regulated data
Corrupt AI workflows
Undermine trust in AI systems

Because exploitation does not require credentials, attackers do not need to bypass authentication — it simply does not exist on affected endpoints.

Root Cause Analysis

The vulnerability stems from missing authentication middleware on multiple API routes. While the UI or frontend may enforce login, the backend APIs themselves:

Do not verify authentication tokens
Do not validate sessions
Do not enforce role or permission checks

This results in implicit trust of unauthenticated requests, a common but dangerous architectural flaw in API-driven systems.

Attack Surface Overview

The exposed attack surface includes:

REST API endpoints under /api/
Message and conversation management routes
Transaction and execution history APIs
Workflow and flow configuration endpoints

These endpoints are reachable as long as the Langflow service is accessible over the network.

Exploitation Details

How an Attacker Exploits This

Identify a reachable Langflow instance.
Send direct HTTP requests to backend APIs.
No authentication challenge is issued.
Backend responds with data or executes the action.

This can be automated easily and scaled for mass exploitation.

Example Exploit Payloads

Retrieve all conversations

GET /api/v1/conversations

Retrieve messages

GET /api/v1/messages

Delete a message

DELETE /api/v1/messages/{message_id}

Access transaction logs

GET /api/v1/transactions

All requests succeed without Authorization headers or session cookies.

Impact Analysis

Confidentiality

Unauthorized access to private conversations
Exposure of prompts, responses, and internal logic

Integrity

Message deletion
Workflow manipulation
Data corruption

Availability

Disruption of AI workflows
Loss of historical data
Potential service instability

Indicators of Compromise (IOCs)

Network-Level IOCs

API access from unfamiliar IP ranges
High request volume to /api/v1/*
Requests lacking authentication headers

Common abused endpoints

/api/v1/conversations
/api/v1/messages
/api/v1/transactions
/api/v1/flows

HTTP-Level IOCs

Requests missing:

Authorization
Cookie
X-API-Key

Yet returning:

200 OK
204 No Content

Application-Level IOCs

Actions logged with user_id = null
Missing session identifiers
Destructive actions without login context

Behavioral IOCs

Sudden disappearance of messages or conversations
One IP accessing data across multiple users
API usage outside business hours
Workflow runs without user interaction

Example IOC Log Entry

IP: 91.xxx.xxx.xxx
Method: GET
Endpoint: /api/v1/conversations
Auth: None
Response: 200

This is abnormal and should trigger investigation.

Detection & Threat Hunting

Core Detection Logic

IF request.path STARTS WITH "/api/"
AND auth_context IS NULL
AND response.status IN (200,204)
THEN ALERT

Data Scraping Pattern

Multiple GET requests
To /api/v1/conversations
With incremental IDs
From same IP
Without authentication

Destructive Activity Detection

DELETE /api/v1/messages/*
DELETE /api/v1/conversations/*

Executed without authentication = Critical severity event

False Positives to Consider

Health check endpoints explicitly designed to be public
Internal monitoring tools accessing APIs without auth (misconfiguration)
Reverse proxy stripping headers incorrectly

These should be reviewed but not assumed safe by default.

Log Sources Required

Langflow application logs
Web server logs (NGINX / Apache)
API gateway or reverse proxy logs
WAF logs
Network firewall logs

Key fields:

Source IP
HTTP method
Endpoint
Authentication state
Response code
Timestamp

MITRE ATT&CK Mapping

T1190 – Exploit Public-Facing Application
T1552 – Exposure of Sensitive Information
T1485 – Data Destruction
T1078 – Valid Accounts (bypassed entirely)

Proof of Concept Status

No advanced PoC required.
Exploitation is possible using basic HTTP clients, making this vulnerability highly attractive to attackers.

Remediation

Immediate Actions

Upgrade to Langflow 1.7.0.dev45
Block public access to Langflow if not required
Review logs for unauthorized access
Validate integrity of conversations and workflows
Rotate any credentials referenced in flows

Compensating Controls (If Patch Is Delayed)

Restrict access via firewall or IP allowlists
Place Langflow behind an authenticated reverse proxy
Enable WAF rules for unauthenticated API access
Disable unused API endpoints

Official Patch

The vulnerability is fixed in Langflow 1.7.0.dev45, which enforces authentication and authorization checks on affected APIs.

Official Patch Link:
https://github.com/langflow-ai/langflow/releases/tag/1.7.0.dev45

Security Hardening Recommendations

Enforce authentication at every API endpoint
Implement role-based access control (RBAC)
Never rely on frontend-only security
Conduct API security reviews regularly
Treat AI tooling as production-grade infrastructure

Final Takeaway

CVE-2026-21445 represents a critical breakdown of access control that allows total compromise of Langflow data and functionality.
Any exposed, unpatched instance should be considered at immediate risk and addressed without delay.