CVE-2026-5022

CVE-2026-5022 (Langflow) : The endpoint "/api/v1/files/images/{flow_id}/{file_name}" lacks authentication/authorization, enabling any unauthenticated user to download images from any flow by guessing the flow_id and file_name. This is documented in both the CVE list and the CVE entry as a missing...