PyPI: langflow
CVE-2026-21445
Safety vulnerability ID: SFTY-20260102-97829
Safety legacy ID: pyup.io-83855
Affected versions of the langflow and langflow-base packages are vulnerable to Improper Authentication due to missing FastAPI authentication dependencies on sensitive monitoring routes. The src/backend/base/langflow/api/v1/monitor.py module defines the /api/v1/monitor/messages (get_messages), /api/v1/monitor/transactions (get_transactions), and /api/v1/monitor/messages/session/{session_id} (delete_messages_session) endpoints without dependencies=[Depends(get_current_active_user)], leaving these handlers reachable without any user identity or authorization checks.
Overview
Langflow Missing Authentication on Critical API Endpoints
Advisory
Affected versions of the langflow and langflow-base packages are vulnerable to Improper Authentication due to missing FastAPI authentication dependencies on sensitive monitoring routes. The src/backend/base/langflow/api/v1/monitor.py module defines the /api/v1/monitor/messages (get_messages), /api/v1/monitor/transactions (get_transactions), and /api/v1/monitor/messages/session/{session_id} (delete_messages_session) endpoints without dependencies=[Depends(get_current_active_user)], leaving these handlers reachable without any user identity or authorization checks.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260102-97829/CVE-2026-21445
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21445
- https://github.com/advisories/GHSA-c5cp-vx83-jhqx
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
- https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
- https://nvd.nist.gov/vuln/detail/CVE-2026-21445
- https://github.com/langflow-ai/langflow/releases/tag/1.7.1
- https://github.com/advisories/GHSA-c5cp-vx83-jhqx
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more