CVE-2026-6598: Langflow Information Disclosure Flaw

CVE-2026-6598 Overview

A cleartext storage vulnerability has been identified in langflow-ai Langflow versions up to 1.8.3. The vulnerability exists in the create_project/encrypt_auth_settings function within the file src/backend/base/Langflow/api/v1/projects.py, which is part of the Project Creation Endpoint. Manipulation of the auth_settings argument results in sensitive authentication credentials being stored in cleartext on disk, potentially exposing them to unauthorized access.

Critical Impact

Authentication credentials may be stored in cleartext, allowing attackers with local or remote access to retrieve sensitive information and potentially compromise user accounts or connected services.

Affected Products

• langflow-ai Langflow up to version 1.8.3

Discovery Timeline

• 2026-04-20 - CVE-2026-6598 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6598

Vulnerability Analysis

This vulnerability falls under CWE-312 (Cleartext Storage of Sensitive Information). The affected component is the Project Creation Endpoint in Langflow, specifically the create_project/encrypt_auth_settings function. Despite the function name suggesting encryption functionality, the implementation fails to properly encrypt authentication settings before writing them to disk.

When a user creates a project with authentication settings, the auth_settings argument is processed by this function. However, due to the vulnerability, these settings—which may contain API keys, passwords, or other authentication credentials—are stored in plaintext format within project files on the server's file system.

The vulnerability is exploitable remotely by authenticated users who can create projects through the Langflow API. The exploit has been publicly disclosed, and the vendor was contacted about this issue but did not respond.

Root Cause

The root cause of this vulnerability is improper handling of sensitive data in the encrypt_auth_settings function. The function either fails to implement encryption entirely, uses a broken encryption mechanism, or has a code path that bypasses the encryption step when storing authentication settings to disk. This results in credentials being written in cleartext where they can be accessed by other users or processes with file system access.

Attack Vector

The attack can be launched remotely over the network by any authenticated user with permissions to create projects. An attacker could exploit this vulnerability through the following approach:

1. Create a project via the Langflow API with specially crafted auth_settings
2. Access the stored project files on disk (either through another vulnerability, compromised credentials, or legitimate file system access)
3. Read the cleartext authentication credentials from the stored files
4. Use the extracted credentials to access connected services or escalate privileges

The vulnerability is particularly concerning in multi-tenant environments where multiple users share the same Langflow instance, as one user's credentials could potentially be exposed to others with file system access.

Detection Methods for CVE-2026-6598

Indicators of Compromise

• Presence of plaintext credentials or API keys in project configuration files under the Langflow data directory
• Unusual file access patterns to project configuration files by unauthorized processes or users
• Authentication failures or suspicious activity on connected services that may indicate credential theft

Detection Strategies

• Implement file integrity monitoring on Langflow project directories to detect unauthorized access to configuration files
• Audit project creation API calls and review auth_settings parameters for sensitive data
• Scan project storage directories for files containing credential patterns such as API keys, passwords, or tokens in cleartext

Monitoring Recommendations

• Enable logging for all Project Creation Endpoint API calls and monitor for anomalous patterns
• Monitor file system access events for the src/backend/base/Langflow/ directory and related project storage paths
• Implement alerting for any unauthorized file read operations on Langflow configuration and project files

How to Mitigate CVE-2026-6598

Immediate Actions Required

• Upgrade Langflow to a version beyond 1.8.3 if a patched version becomes available from the vendor
• Review existing project files for cleartext credentials and rotate any exposed authentication credentials immediately
• Restrict file system access to Langflow project directories to only essential system accounts
• Consider temporarily disabling the Project Creation Endpoint if credential security is critical to your environment

Patch Information

At the time of publication, the vendor (langflow-ai) was contacted about this vulnerability but did not respond. Users should monitor the official Langflow GitHub repository for security updates and patches. Additional technical details are available via the VulDB advisory and the GitHub Gist PoC resource.

Workarounds

• Implement network-level restrictions to limit access to the Langflow API to trusted networks only
• Apply file system permissions to ensure only the Langflow service account can access project configuration files
• Avoid storing sensitive authentication credentials in project configurations until a patch is available; use environment variables or external secret management solutions instead
• Deploy application-level encryption for sensitive data before it reaches the Langflow API