CVE-2026-5025 — Langflow - Application Logs Exposed to All Authenticated Users

CVE-2026-5025

Langflow - Application Logs Exposed to All Authenticated Users PUBLISHED

Description (CNA)

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').

Affected (CNA)

Vendor / product	Versions
langflow-ai / langflow	affected 0

CWE

CWE-862

References

https://www.tenable.com/security/research/tra-2026-23

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.