CVE-2026-6597

LOW

langflow-ai langflow Flow Using API core.py has_api_terms credentials storage

Title source: cna
STIX 2.1

Description

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory
Submit #791920 | Langflow <= 1.8.3 Information Disclosure
https://vuldb.com/submit/791920
Vdb Entry, Technical Description vdb-entry technical-description
VDB-358232 | langflow-ai langflow Flow Using API core.py has_api_terms credentials storage
https://vuldb.com/vuln/358232
Signature, Permissions Required signature permissions-required
VDB-358232 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/358232/cti

Scores

CVSS v3 2.7
EPSS 0.0032
EPSS Percentile 23.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-255 CWE-256
Status published
Products (5)
langflow-ai/langflow 1.8.0
langflow-ai/langflow 1.8.1
langflow-ai/langflow 1.8.2
langflow-ai/langflow 1.8.3
pypi/langflow 0PyPI
Published Apr 20, 2026
Tracked Since Apr 20, 2026