CVE-2026-21445

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 33.29%
EPSS Percentile: 98.37%
CISA KEV: Not listed

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 03-Jan-2026 03:16
Last Modified: 17-Jun-2026 17:18
EPSS Date: 2026-10-30
CWE: CWE-306

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:P /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

langflow / langflow Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 1.7.1
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

References

Last enrichment sync: 31-Oct-2026 17:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

activity targeting other Langflow vulnerabilities this year, including CVE-2026-0770, CVE-2026-33017, CVE-2026-21445, and CVE-2025-34291, the last of which has been weaponized by the Iranian state-sponsored group known Unpatched Langflow CVE-2026-5027 Exploited in the Wild

CVE (4)

People (1)

Threat Actors (1)

MITRE ATT&CK (1)

Vendors (2)

Products (1)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.