CVE-2026-6597: langflow-ai langflow Credentials Management Errors
Vulnerability summary
CVE-2026-6597 is a medium (CVSS 5.1) Credentials Management Errors vulnerability in langflow-ai langflow. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 20-04-2026PublishedVulnerability first disclosed.
- 20-04-2026Last modifiedVulnerability information updated.
Description
A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
9 scores · 3 sources · 4 versions- OSV · PypiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
- NVDNIST2.0LowCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · PypiEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- NVDNIST3.3LowAV:N/AC:L/Au:M/C:P/I:N/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
+0.06 pp
From 0.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundB93261C6E651F14800A4F2E4365F357B
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Langflow-ai1 product
- langflow1.8.0 | 1.8.1 | 1.8.2 | 1.8.3
PyPI1 product
- langflow≤ 1.8.3
2 vendors · 2 products
References
8 links
- pypi.org/project/langflowPACKAGE