Langflow OSS - Superuser Token Issuance
CVE-2026-9103
Verified
Description
Langflow OSS with default AUTO_LOGIN exposes `/api/v1/auto_login`, which returns a superuser access token to any unauthenticated request.
Severity
Critical
CVSS Score
9.8
Exploit Probability
3%
Affected Product
langflow
Published Date
September 10, 2026
Template Author
str4k3r
CVE-2026-9103.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-9103
CWE ID:
cwe-306
Remediation Steps
Disable AUTO_LOGIN by setting `LANGFLOW_AUTO_LOGIN=false`, configure strong superuser credentials, upgrade to a fixed Langflow release, and restrict network exposure of the management interface.