CVE-2026-5025 — Langflow - Application Logs Exposed to All Authenticated Users
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authenticatio…
Published: 2026-03-27 · CVSS: 6.5 · CVSS 3.1
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7