Langflow <= 1.8.3 Information Disclosure via Flawed remove_api_keys Logic

Vulnerability Summary Vulnerability ID: #791920 Vulnerability Name: Langflow <= 1.8.3 Information Disclosure Vulnerability Type: Sensitive Information Leakage Overview Langflow has an information disclosure vulnerability when exporting JSON files. The application fails to properly remove sensitive credentials due to a logic flaw in the function. This function only strips values when a field is marked as and its name strictly contains both and either or . If a sensitive field is named only , , or , it bypasses this logic, resulting in plaintext leakage. Impact Scope Sensitive Information Leakage: Database credentials, third-party service keys, and other confidential data are exposed in the exported JSON file. Security Risk: Unauthorized users can obtain plaintext credentials by extracting these flow export files, potentially enabling attacks on externally integrated infrastructure. Remediation No specific code patch is currently provided on the page, but the root cause is identified as the overly strict naming heuristic logic in the function. The fix requires improving the function’s logic to correctly identify and remove all fields marked as sensitive ( ), rather than being limited to field names containing specific keywords. POC / Exploit Code Vulnerable Code Location: Vulnerable Function: Exploitation Steps: 1. An attacker (or regular user) creates a flow containing a sensitive field (e.g., named "password") marked with . 2. The user includes a highly sensitive string in the flow, such as . 3. The user downloads the flow via the API ( ). 4. The downloaded JSON file displays the plaintext , because the function incorrectly decides to retain it.

Goal Reached Thanks to every supporter — we hit 100%!

Langflow <= 1.8.3 Information Disclosure via Flawed remove_api_keys Logic