{"id":"CVE-2026-34046","aliases":["GHSA-8c4j-f57c-35cf","PYSEC-2026-2567","PYSEC-2026-2570"],"url":"https://o3.security/vulnerability/CVE-2026-34046","summary":"Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check","details":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user.","published":"2026-03-27T20:06:35.836Z","modified":"2026-07-15T02:19:21.598765965Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"langflow","fixedVersion":"1.5.1"},{"ecosystem":"PyPI","name":"langflow-base","fixedVersion":"0.5.1"}],"fix":{"url":"https://github.com/langflow-ai/langflow/pull/8956","label":"langflow-ai/langflow#8956"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34046.json"},{"type":"ADVISORY","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34046"},{"type":"FIX","url":"https://github.com/langflow-ai/langflow/pull/8956"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T02:19:21.598765965Z"}}