jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +1 more potentially affected by CVE-2026-5022 via langflow-base (>=0.7.2, <=0.11.3rc0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.8.0rc0, =1.8.0rc2 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-5022 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15840036...

CVE-2026-5022

CVE-2026-5022 (Langflow) : The endpoint "/api/v1/files/images/{flow_id}/{file_name}" lacks authentication/authorization, enabling any unauthenticated user to download images from any flow by guessing the flow_id and file_name. This is documented in both the CVE list and the CVE entry as a missing...