PT-2026-26781 · Langflow · Langflow

R00Tuser111 · Publicado 2026-03-20 · Atualizado 2026-04-16 · CVE-2026-33497

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.1

Description Langflow is a tool for building and deploying AI-powered agents and workflows. In the download profile picture function of the /profile pictures/{folder name}/{file name} API endpoint, the folder name and file name parameters are not strictly filtered. This allows an attacker to read the secret key across directories. The secret key is used for JWT authentication, enabling attackers to forge authentication tokens and log into the system.

Recommendations Versions prior to 1.7.1 should be updated to version 1.7.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-33497

GHSA-PH9W-R52H-28P7

PYSEC-2026-81

Produtos afetados

Langflow

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33497.json · Exploit
• https://github.com/langflow-ai/langflow · Nota
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7 · Aviso do Fabricante
• https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2026-81.yaml · Nota
• https://twitter.com/VulmonFeeds/status/2036523855041200163 · Publicação no Twitter
• https://osv.dev/vulnerability/PYSEC-2026-81 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33497 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ph9w-r52h-28p7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33497 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036505788416680247 · Publicação no Twitter
• https://twitter.com/sshivasurya/status/2044573679380558196 · Publicação no Twitter