CVE-2026-21445 is a critical missing authentication flaw (CVSS 9.1) in Langflow, the tool for building AI agents and workflows. Three monitor API endpoints answer without a login and expose conversations and transaction history, and one deletes messages. The GitHub advisory lists 1.7.1 as the patched version.
What's affected
The NVD record and the GitHub advisory disagree slightly on versions, so read both. The record says versions before 1.7.0.dev45 are affected and that 1.7.0.dev45 contains the fix. The GitHub advisory GHSA-c5cp-vx83-jhqx lists versions up to 1.7.0 as affected and 1.7.1 as patched. Upgrading to 1.7.1 or later satisfies both statements.
The weakness is CWE-306 (missing authentication for a critical function). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, so it is reachable over the network, needs no account and no user interaction, and scores high for confidentiality and integrity.
The advisory names three endpoints in the monitor module of the backend API: one that returns messages, one that returns transactions, and one that deletes the messages of a session. Other endpoints in the same file already required a logged in user, which is how the gap was found. The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the installed version first.
pip show langflow | grep -i ^version
For Docker, look at the image tag you run.
docker ps --format "{{{{.Image}}}}" | grep -i langflow
If you cannot tell, check the version in the web interface or in your deployment files.
Then check exposure. From a machine outside your network, ask whether your Langflow address answers at all. A Langflow server reachable from the internet is the highest priority. Review reverse proxy logs for requests to paths beginning with /api/v1/monitor from addresses that are not your own users, and check whether stored conversations were read in bulk or deleted unexpectedly.
If Langflow is part of a larger Python project, the free in-browser scan can read your requirements file and flag the package version.
What to do now
- Upgrade Langflow to 1.7.1 or later. For pip installs, use pip install with a lower bound of 1.7.1 and then confirm the version again.
- Do not expose Langflow directly to the internet. Put it behind a VPN or a reverse proxy that enforces login, and allow only known addresses.
- Treat stored conversations and transaction records as exposed if the server was reachable before the upgrade. Decide with your privacy team whether this is a notifiable event.
- Rotate API keys and model provider credentials that appear in workflow history or in stored messages.
- Check backups for deleted messages, and compare message counts if you rely on them for audit.
- Add Langflow to continuous dependency monitoring so the next fix reaches you without a manual check.
Why it matters
The cause is an inconsistency. The monitor module protects some routes with a dependency that requires an active user, and three routes were registered without it. Nothing in the framework forces authentication, so each route is protected only if the author remembered. That pattern is common: it is hard to see by eye, easy to see with a test that calls every route without credentials.
The data matters because Langflow stores what people said to the agents they built. Those conversations can hold personal data, internal questions and secrets that users pasted into a chat, and the transaction history shows how flows ran. A server open to the internet turns that history into something anyone can read. The delete endpoint adds an integrity problem, since messages used as evidence or audit trail can be removed.
AI tooling tends to be adopted quickly, from a laptop demo to a shared server, and it often skips the review that a normal internal service gets. An API security scan that calls each route without a token catches this class early. The demo below walks through one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version should I upgrade to?
The GitHub advisory names 1.7.1 as the patched version, and the NVD record names 1.7.0.dev45. Moving to 1.7.1 or later covers both statements.
Do I need to worry if Langflow only runs on my laptop?
The risk is much lower if nothing outside the machine can reach it. Check that it listens on localhost only, and still upgrade when you can.
Sources
- GitHub advisory GHSA-c5cp-vx83-jhqx for Langflow
- Fix commit in the Langflow repository
- NVD record for CVE-2026-21445
Last reviewed: 19 October 2026.
