CVE-2026-6598: langflow-ai langflow

Vulnerability summary

CVE-2026-6598 is a medium (CVSS 5.3) vulnerability in langflow-ai langflow. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-04-2026
   PublishedVulnerability first disclosed.
2. 20-04-2026
   Last modifiedVulnerability information updated.

Description

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth_settings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
• CWE-313Cleartext Storage in a File or on DiskThe product stores sensitive information in cleartext in a file, or on disk.