CVE-2026-21445

Multiple critical API endpoints in Langflow, an open-source tool for building and deploying AI-powered agents and workflows, lack required authentication (CWE-306), so any unauthenticated user can reach them directly over the network with no privileges or user interaction required. By sending crafted requests to these endpoints, an attacker can read sensitive user conversation data and transaction histories and can perform destructive operations such as deleting messages. Any organization or individual running an affected Langflow deployment whose API is reachable, especially instances exposed to the internet, is affected, since the endpoints handle personal data and system operations that should require proper authorization. A public proof of concept is available via the project's GitHub security advisory (GHSA-c5cp-vx83-jhqx), EPSS assigns a 33.7% probability of exploitation within 30 days (98th percentile), and recent reporting indicates CISA has added actively exploited Langflow flaws to its KEV catalog, so this should be treated as exploited in the wild. Version 1.7.0.dev45 contains the patch.

What to do: Upgrade Langflow to version 1.7.0.dev45 or later. If you cannot upgrade immediately, restrict access to the affected API endpoints to trusted networks or place them behind an authenticating reverse proxy or API gateway. Review logs for unauthenticated requests to conversation, transaction, and message endpoints, and check for unexpected message deletions or access to user conversation data.