CVE-2026-5022: Langflow

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

Affected products

• Langflow Langflow: affected versions not specified

Published 2026-03-27. Last modified 2026-06-17.