CVE-2026-6598: langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file
A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsettings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6598?
CVE-2026-6598 has been classified with a moderate severity due to its impact on sensitive information management.
How do I fix CVE-2026-6598?
To fix CVE-2026-6598, upgrade langflow to version 1.8.4 or later where the vulnerability has been addressed.
What software is affected by CVE-2026-6598?
CVE-2026-6598 affects langflow-ai langflow versions up to and including 1.8.3.
What does CVE-2026-6598 involve?
CVE-2026-6598 involves the insecure storage of authentication settings in cleartext, exposing sensitive data.
Who should be concerned about CVE-2026-6598?
Users and administrators of langflow-ai langflow versions up to 1.8.3 should be concerned about CVE-2026-6598.