PT-2026-28739 · Langflow Ai · Langflow

CVE-2026-5025 · Publicado 2026-03-27 · Atualizado 2026-03-27

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get current active user') without any privilege checks (e.g., 'is superuser').

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-5025

Produtos afetados

Langflow

Referências · 2

• https://tenable.com/security/research/tra-2026-23 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5025 · Nota de Segurança