CVE-2026-33484

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch.

An attacker targeting an organization using Langflow for AI agent development first identifies an exposed Langflow instance via Shodan, DNS enumeration, or prior reconnaissance. They then call any authenticated Langflow API endpoint that returns flow metadata — or leverage a low-privilege session — to harvest flow_ids. With a flow_id in hand, they issue unauthenticated HTTP GET requests to /api/v1/files/images/{flow_id}/{file_name}. By iterating over predictable filename patterns or using knowledge of Langflow's file naming conventions, they systematically download uploaded images from any user in the deployment. In a corporate context, this exfiltrates proprietary workflow diagrams, data samples, or screenshots used to configure AI agents — all without ever authenticating. The attack requires no AI/ML knowledge and can be scripted in minutes.