CVE-2026-5022 — Langflow - Missing Authorization on download_image Endpoint

CVE-2026-5022

Langflow - Missing Authorization on download_image Endpoint PUBLISHED

Description (CNA)

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

Affected (CNA)

Vendor / product	Versions
langflow-ai / langflow	affected 0

CWE

CWE-862

References

https://www.tenable.com/security/research/tra-2026-23

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.