Vulnerability PYSEC-2026-2568
Medium Risk
MEDIUM RISK
CVSS Score: 4.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 months ago
July 13, 2026 at 03:02 PM UTC
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
0.0.31 - 1.9.0
0.0.31 - 1.9.0
Summary
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
Details
A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth_settings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 months ago
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
0.0.31 - 1.8.4 PYSEC-2026-2566
0.0.31 - 1.8.4 PYSEC-2026-2566
Low Risk
2 months ago
Langflow has an Information Leak through Incomplete API Key Redaction
0.0.31 - 1.8.3 PYSEC-2026-2565
0.0.31 - 1.8.3 PYSEC-2026-2565
Medium Risk
2 months ago
Langflow vulnerable to injection
0.0.31 - 1.8.3 PYSEC-2026-2569
0.0.31 - 1.8.3 PYSEC-2026-2569
Unknown
2 months ago
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
0.0.31 - 1.5.0.post2 PYSEC-2026-2567
0.0.31 - 1.5.0.post2 PYSEC-2026-2567
Unknown
2 months ago
Langflow affected by Remote Code Execution via validate_code() exec()
0.0.31 - 1.7.3 PYSEC-2026-1525
0.0.31 - 1.7.3 PYSEC-2026-1525
Impacted packages
Timeline
Published
2 months ago
July 13, 2026 at 03:02 PM UTC
Fixed (1.9.1)
5 months ago
April 24, 2026 at 12:34 AM UTC
Last Modified
2 months ago
July 13, 2026 at 04:32 PM UTC