CVE-2026-6597: langflow-ai langflow Flow Using API core.py has_api_terms credentials storage
A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function removeapikeys/hasapiterms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
langflow-ai/langflowto a version that resolves this vulnerability.Fixed in 1.8.3 - Compensating control
Because the issue can be initiated remotely and could lead to unprotected storage of credentials, restrict network access to the Flow Using API endpoint that exposes remove_api_keys/has_api_terms so only trusted clients can reach it.
- Operational
Rotate any API keys/credentials that may have been stored due to the unprotected credential storage caused by remove_api_keys/has_api_terms in src/backend/base/langflow/api/utils/core.py (Flow Using API).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6597?
CVE-2026-6597 has been assigned a medium severity rating due to the potential exposure of credentials.
How do I fix CVE-2026-6597?
To address CVE-2026-6597, it is recommended to upgrade langflow-ai langflow to version 1.8.4 or later.
What component is affected by CVE-2026-6597?
CVE-2026-6597 affects the function remove_api_keys/has_api_terms in the file core.py pertaining to the Flow Using API.
What versions of langflow are impacted by CVE-2026-6597?
CVE-2026-6597 impacts langflow-ai langflow versions up to and including 1.8.3.
What are the potential consequences of CVE-2026-6597?
The potential consequences of CVE-2026-6597 include unauthorized access to API credentials stored improperly.