https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:15:16 +0000 https://vulnerability.circl.lu/vuln/cve-2026-21445 <p><strong>Affected:</strong> langflow-ai langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.</p> <p><strong>Affected:</strong> langflow-ai langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.</p> https://vulnerability.circl.lu/vuln/cve-2026-21445 https://vulnerability.circl.lu/vuln/ghsa-c5cp-vx83-jhqx <p><strong>Affected:</strong> PyPI: langflow-base, PyPI: langflow</p> <p>### Summary Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.</p> <p>### Details The vulnerability exists in three API endpoints within `src/backend/base/langflow/api/v1/monitor.py` that are missing the required `dependencies=[Depends(get_current_active_user)]` authentication dependency:</p> <p>**Affected Endpoints:**</p> <p>1. **GET `/api/v1/monitor/messages`** (Line 61) ```python @router.get(&#34;/messages&#34;) # ❌ Missing authentication async def get_messages( session: DbSession, flow_id: Annotated[UUID | None, Query()] = None, session_id: Annotated[str | None, Query()] = None, # ... other parameters ) -&gt; list[MessageResponse]: ```</p> <p>2. **GET `/api/v1/monitor/transactions`** (Line 183) ```python @router.get(&#34;/transactions&#34;) # ❌ Missing authentication async def get_transactions( flow_id: Annotated[UUID, Query()], session: DbSession, params: Annotated[Params | None, Depends(custom_params)], ) -&gt; Page[TransactionTable]: ```</p> <p>3. **DELETE `/api/v1/monitor/messages/session/{session_id}`** (Line 165) ```python @router.delete(&#34;/messages/session/{session_id}&#34;, status_code=204) # ❌ Missing authentication async def dele…</p> <p><strong>Affected:</strong> PyPI: langflow-base, PyPI: langflow</p> <p>### Summary Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.</p> <p>### Details The vulnerability exists in three API endpoints within `src/backend/base/langflow/api/v1/monitor.py` that are missing the required `dependencies=[Depends(get_current_active_user)]` authentication dependency:</p> <p>**Affected Endpoints:**</p> <p>1. **GET `/api/v1/monitor/messages`** (Line 61) ```python @router.get(&#34;/messages&#34;) # ❌ Missing authentication async def get_messages( session: DbSession, flow_id: Annotated[UUID | None, Query()] = None, session_id: Annotated[str | None, Query()] = None, # ... other parameters ) -&gt; list[MessageResponse]: ```</p> <p>2. **GET `/api/v1/monitor/transactions`** (Line 183) ```python @router.get(&#34;/transactions&#34;) # ❌ Missing authentication async def get_transactions( flow_id: Annotated[UUID, Query()], session: DbSession, params: Annotated[Params | None, Depends(custom_params)], ) -&gt; Page[TransactionTable]: ```</p> <p>3. **DELETE `/api/v1/monitor/messages/session/{session_id}`** (Line 165) ```python @router.delete(&#34;/messages/session/{session_id}&#34;, status_code=204) # ❌ Missing authentication async def dele…</p> https://vulnerability.circl.lu/vuln/ghsa-c5cp-vx83-jhqx