CVE-2026-21445

Langflow is like a “workshop” for building and running AI agent workflows, including storing user messages and related data. This bug is like leaving the workshop’s storage room door unlocked: outsiders can walk in without a login and either read the contents or delete messages. If your business uses Langflow publicly or on a reachable network, this can directly expose and destroy your users’ data.

This matters if you run langflow or langflow-base and expose its API endpoints on a network where other people can reach them. The bug does not require login and does not require someone to “click” anything for the attack to work. Because it depends on network reachability, you should treat it as a risk if your Langflow server is reachable from the internet or otherwise reachable by untrusted parties.

This is RED because attackers don’t need an account to access and delete sensitive user data/messages—making it straightforward to exploit once endpoints are reachable. The advisory is driving increased attention, and the fix has specific patched versions; you should prioritize upgrading right away.

1. Confirm exposure (quick checks)

   • Identify your deployed components and versions for both “langflow” and “langflow-base”.
   • Determine whether the Langflow service is reachable from untrusted networks (for example, accessible from the public internet, or reachable from broader networks than intended).
   • If you have a staging environment, test there first.

2. Determine whether you are affected

   • If your langflow version is prior to 1.7.1, and/or your langflow-base version is prior to 0.7.1, you should treat the deployment as affected based on the vendor’s fixed-version guidance.

3. Upgrade to the fixed versions

   • Upgrade langflow to 1.7.1.
   • Upgrade langflow-base to 0.7.1.
   • Use the vendor’s linked security advisory for the official upgrade instructions and any migration notes.

4. Validate the fix

   • After upgrading, attempt requests to the previously exposed API endpoints without authentication.
   • Confirm that unauthenticated users can no longer read user messages/data and cannot perform destructive actions like message deletion.
   • Confirm the application is functioning normally for authenticated/legitimate use.

5. If you cannot upgrade immediately (temporary mitigation)

   • Restrict network access to the Langflow server so only trusted clients/networks can reach it (for example, allowlist specific IPs/VPN, and block public access to the API).
   • Confirm firewall rules and reverse proxy settings are enforced and that untrusted traffic cannot reach the vulnerable endpoints.

6. Monitor after remediation

   • Watch for unusual request patterns targeting API endpoints from unexpected sources.
   • Review access logs around the time of any suspicious activity and consider rotating any exposed credentials (even though this issue itself does not require authentication, logs can reveal other weaknesses).

Severity is CRITICAL (CVSS 9.1) with network access and no privileges required. The weakness is CWE-306 (missing authentication for critical functions). The mechanism is that critical API endpoints in langflow/langflow-base are missing authentication checks, enabling unauthenticated attackers to access sensitive user conversation data and perform destructive operations including message deletion. KEV does not list this issue, and there is no clear dated press claim of real-world exploitation in the findings; however, EPSS is predicted to be rising and traffic attention is increasing due to the advisory. Fix availability is clear: langflow fixed in 1.7.1 and langflow-base fixed in 0.7.1.