CVE-2026-5022: Langflow - Missing Authorization on download_image Endpoint
The '/api/v1/files/images/{flowid}/{filename}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5022?
CVE-2026-5022 is categorized as a high-severity vulnerability due to the lack of authentication and authorization on the download_image endpoint.
How do I fix CVE-2026-5022?
To fix CVE-2026-5022, implement proper authentication and authorization checks on the '/api/v1/files/images/{flow_id}/{file_name}' endpoint.
What impact does CVE-2026-5022 have on security?
CVE-2026-5022 allows unauthenticated users to download sensitive images, posing a significant risk to data confidentiality.
Which versions of Langflow are affected by CVE-2026-5022?
CVE-2026-5022 affects all versions of Langflow that utilize the vulnerable '/api/v1/files/images/{flow_id}/{file_name}' endpoint.
Is CVE-2026-5022 being actively exploited?
As of now, there is no public information indicating active exploitation of CVE-2026-5022.