langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file

published 2026-04-20 6 mo ago modified 2026-07-13 3 mo ago also GHSA-9jpj-cph8-w449 , PYSEC-2026-2568 , EUVD-2026-23760

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits: 0; none known

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth_settings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Patch / fix

fixed in 1 links 1

pypi langflow 1.9.1

github.com/langflow-ai/langflow@45325f6 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-20)

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gist.github.com https://gist.github.com/chenhouser2025/77adb3486c06c635ae4b09a3eaf90213 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N
OSV	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	langflow	<1.9.1	1.9.1

Affected products

langflow-ai langflow

Classification

Weakness

CWE-313 Cleartext Storage in a File or on Disk
CWE-312 Cleartext Storage of Sensitive Information

References

github.com /langflow-ai/langflow/commit/45325f6376309a91f5017fa033a96c09c7e295e3
web
gist.github.com /chenhouser2025/77adb3486c06c635ae4b09a3eaf90213
exploit, web
vuldb.com /vuln/358233
vdb-entry, technical-description, web
vuldb.com /vuln/358233/cti
signature, permissions-required, web
vuldb.com /submit/791921
third-party-advisory, web
nvd.nist.gov /vuln/detail/CVE-2026-6598
advisory
github.com /langflow-ai/langflow
package
pypi.org /project/langflow
package
github.com /advisories/GHSA-9jpj-cph8-w449
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary