CVE-2026-6597 - langflow-ai langflow Flow Using API core.py has_api_terms credentials storage

Back Back to CVE browser

MEDIUM

langflow-ai langflow Flow Using API core.py has_api_terms credentials storage

Published Apr 20, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Langflow-AI Product Langflow Default
n/a
- Version
  1.8.0
  Status
  affected
  Constraints
  -
- Version
  1.8.1
  Status
  affected
  Constraints
  -
- Version
  1.8.2
  Status
  affected
  Constraints
  -
- Version
  1.8.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Langflow-AI

Langflow

n/a

Version	Status	Constraints
1.8.0	affected	-
1.8.1	affected	-
1.8.2	affected	-
1.8.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-255

CWE-256

References (6)

https://gist.github.com/chenhouser2025/b93261c6e651f14800a4f2e4365f357b
exploit
https://github.com/advisories/GHSA-5jjf-wcvf-923w
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6597
https://vuldb.com/submit/791920
third-party-advisory
https://vuldb.com/vuln/358232
vdb-entrytechnical-description
https://vuldb.com/vuln/358232/cti
signaturepermissions-required

Link	Providers	Tags
https://gist.github.com/chenhouser2025/b93261c6e651f14800a4f2e4365f357b		exploit
https://github.com/advisories/GHSA-5jjf-wcvf-923w		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6597
https://vuldb.com/submit/791920		third-party-advisory
https://vuldb.com/vuln/358232		vdb-entrytechnical-description
https://vuldb.com/vuln/358232/cti		signaturepermissions-required