Langflow < 1.9.0 Missing Authorization (CVE-2026-33760)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(326242);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/13");

  script_cve_id("CVE-2026-33760");

  script_name(english:"Langflow < 1.9.0 Missing Authorization (CVE-2026-33760)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a missing authorization vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Langflow installed on the remote host is prior to 1.9.0. It is, therefore,
affected by a missing authorization vulnerability:

  - The /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete
    operations on user-owned resources without verifying that the authenticated requester owns
    the targeted resource. Any authenticated user can read, modify, rename, or permanently
    delete another user's messages, sessions, build artifacts, and LLM transaction logs by
    supplying the target's resource ID or flow_id. (CVE-2026-33760)

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  # https://github.com/langflow-ai/langflow/security/advisories/GHSA-9c59-2mvc-vfr8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cd9562d3");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Langflow version 1.9.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33760");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/10");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:langflow:langflow");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_langflow_detect.nasl", "langflow_web_detect.nbin");
  script_require_keys("installed_sw/Langflow");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Langflow', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '1.9.0'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);