CVE-2026-33484

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch.

• CWE-284
• CWE-639
• CWE-862

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-7grx-3xcx-2xv5Exploit, Vendor Advisory
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-7grx-3xcx-2xv5Exploit, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33479WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-3348The MinhNhut Link Gateway plugin for WordPress is vulnerable…4.4
• CVE-2026-33480WWBN AVideo is an open source video platform. In versions up…8.6
• CVE-2026-33481Syft is a a CLI tool and Go library for generating a Softwar…5.3
• CVE-2026-33482WWBN AVideo is an open source video platform. In versions up…8.1
• CVE-2026-33483WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33485WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33486Roadiz is a polymorphic content management system based on a…6.5
• CVE-2026-33487goxmlsig provides XML Digital Signatures implemented in Go. …7.5
• CVE-2026-33488WWBN AVideo is an open source video platform. In versions up…8.1
• CVE-2026-33489CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-3349The MinhNhut Link Gateway plugin for WordPress is vulnerable…6.1