CVE-2026-21445: Langflow Critical API Endpoints Lacking Authentication
Summary
CVE-2026-21445: Langflow Missing Authentication on Critical API Endpoints. Affects langflow-base versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Also tracked for
- langflow · PyPI
The same CVE-2026-21445 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework designed for building and managing conversational AI applications. It provides a set of tools and APIs that enable developers to create, monitor, and analyze user interactions. However, certain API endpoints in Langflow are vulnerable due to missing authentication controls, which can expose sensitive user data and allow unauthorized actions.
Vulnerability Detail
The vulnerability arises from multiple critical API endpoints in Langflow that lack proper authentication mechanisms. Specifically, three endpoints are affected: GET /api/v1/monitor/messages, GET /api/v1/monitor/transactions, and DELETE /api/v1/monitor/messages/session/{session_id}. These endpoints allow unauthenticated users to access sensitive user conversation data, transaction histories, and perform destructive actions such as deleting messages. The absence of authentication exposes all Langflow users to potential data breaches, privacy violations, and compliance risks, as unauthorized individuals can access personal information and system logs.
How To Fix
Latest published version: 1.14.0.dev3 as of 23 Oct 2026
pip install --upgrade "langflow-base==1.14.0.dev3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1
This is the first release that contains the fix.
pip install --upgrade "langflow-base==1.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy or API gateway that requires authentication for all incoming requests to the affected endpoints until the package is updated.
Conclusion
The vulnerability CVE-2026-21445 in Langflow poses significant risks due to the lack of authentication on critical API endpoints. It is crucial for users to update to the latest version and implement the recommended fixes to safeguard sensitive data and maintain compliance with data protection regulations.
See every vulnerability recorded for langflow-base →
FAQ
CVE-2026-21445 is a vulnerability in Langflow where critical API endpoints lack authentication, allowing unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized access to user conversations, exposure of transaction histories, and the ability for malicious actors to delete messages.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To secure your Langflow application, update to version 1.5.1 or later and ensure all API endpoints have proper authentication mechanisms in place.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow-base.
