CVE-2026-5025 PUBLISHED

Langflow - Application Logs Exposed to All Authenticated Users

Assigner: tenable
Reserved: 27.03.2026 Published: 27.03.2026 Updated: 27.03.2026

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor langflow-ai
Product langflow
Versions Default: unaffected
  • Version 0 is affected

References

Problem Types

  • CWE-862 Missing Authorization CWE