Langflow < 1.9.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(326241);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/10");

  script_cve_id("CVE-2026-55255", "CVE-2026-55450");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/07/10");

  script_name(english:"Langflow < 1.9.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Langflow installed on the remote host is prior to 1.9.1. It is, therefore,
affected by multiple vulnerabilities:

  - An Insecure Direct Object Reference (IDOR) vulnerability in the /api/v1/responses
    endpoint allows an authenticated attacker to execute any flow belonging to another user
    by specifying the victim's flow ID in the request. (CVE-2026-55255)

  - Unauthenticated users can upload any amount of data to the server without any limitations,
    requiring only network access to Langflow. This can lead to space exhaustion on the server.
    In addition, the absolute path of the uploaded file is reported in the response, which is
    an information leak that can assist in chaining other attack primitives. (CVE-2026-55450)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  # https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ce119ea1");
  # https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?52eb5616");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Langflow version 1.9.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55255");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-55450");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/10");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:langflow:langflow");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_langflow_detect.nasl", "langflow_web_detect.nbin");
  script_require_keys("installed_sw/Langflow");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Langflow', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '1.9.1'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);