Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33484 Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpo… https://www.cve.org/CVERecord?id=CVE-2026-33484
Post summary
The brief excerpt identifies CVE-2026-33484 in Langflow and notes a specific endpoint affected in certain versions, but it offers no further details on exploitation, patches, or technical analysis.
CVE-2026-33484 Unauthenticated Image Disclosure Vulnerability in Langflow 1.0.0-1.8.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33484
Post summary
The post announces CVE‑2026‑33484, an unauthenticated image disclosure vulnerability in Langflow 1.0.0‑1.8.1, and links to a vulnerability details page.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |