What is CVE-2026-5022?

CVE-2026-5022 is a medium-severity vulnerability in Langflow, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-03-27.

How severe is CVE-2026-5022?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Langflow

CVE-2026-5022

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

Vulnerability class: Broken Access Control

EPSS: 0.002 (10.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Langflow
Langflow-ai Langflow — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

vulnreport@tenable.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-5022?: CVE-2026-5022 is a medium-severity vulnerability in Langflow, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-03-27.
How severe is CVE-2026-5022?: Medium severity. CVSS v3 base score is 5.3 out of 10.