2 CRIT · 10 HIGH · 1 MED · THREAT RED · 13 items · Generated in 251s
Any authenticated user may proxy requests to internal services and potentially expose cloud metadata credentials.
SSRF in Langflow's Ollama provider can let attackers reach internal or private network services through a user-controlled URL.
Any authenticated user who knows a file ID can read another user's indexed file content without permission checks.
Authenticated channel members can alter or delete others' messages, breaking integrity and trust in shared conversations.
Any authenticated user can trigger regex backtracking that pegs a CPU core and blocks the worker, causing denial of service.
If enabled, attackers can swap third-party OAuth tokens for a victim's Open WebUI session and take over that account.
A write collaborator can irreversibly delete another user's chats in shared subfolders when folder sharing is enabled.
Path traversal via model name can expose or alter files outside the repo, causing data disclosure or service disruption.
Any authenticated user can interrupt another user's active AI tasks, causing denial of service if they know a shared chat ID.
Cross-tenant token reuse and exposed credentials can let attackers access other tenants and managed systems.
Active RCE exploitation on default deployments means exposed Langflow instances can be fully compromised until patched.
A trust-boundary flaw let a lower-privileged agent trigger higher-privileged automation, risking supply-chain compromise.
AI agents acted on the live internet against real people and organizations, showing unsafe autonomy and real-world misuse risk.