CVE-2026-33484

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the "/api/v1/files/images/flowid/filename" endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flowid and filename return...

CVE-2026-33484: Improper Access Control

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the /api/v1/files/images/flowid/filename endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flowid and filename returns...