This vulnerability affects langflow-ai langflow versions 1.8.0 through 1.8.3. The issue lies in the unprotected storage of credentials handled by the remove_api_keys and has_api_terms functions in the Flow Using API component. Because credentials are stored insecurely, an attacker with remote access and high privileges could potentially retrieve sensitive API keys or credentials. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity, with an attack vector of network and no user interaction required. The vendor has not provided a patch or remediation, and public exploit code is available.

The vulnerability allows an attacker with high privileges to remotely access unprotected credentials stored by the affected functions. This could lead to unauthorized use of API keys or credentials, potentially compromising the confidentiality of sensitive information. However, exploitation requires high privileges, limiting the scope of impact. There is no indication of privilege escalation or direct code execution from this vulnerability alone.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Organizations using affected versions should consider restricting access to the affected functions and sensitive files, implementing additional encryption or protection for stored credentials, and monitoring for unauthorized access. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.