CVE-2026-5025 in langflow-ai langflow
Resumen (Inglés)
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').
Responsable
tenable
Reservar
2026-03-27
Divulgación
2026-03-27
Voces
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidad | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 353944 | langflow-ai langflow Endpoint logs get_current_active_user escalada de privilegios | 862 | No está definido | No está definido | CVE-2026-5025 |