This vulnerability affects the langflow-ai langflow project creation endpoint, specifically the create_project/encrypt_auth_settings function in src/backend/base/Langflow/api/v1/projects.py. Improper manipulation of the auth_settings argument results in sensitive authentication data being stored in cleartext on disk. The flaw allows remote attackers to potentially access sensitive credentials or configuration data. The issue is present in versions 1.8.0 through 1.8.3. No patch or official fix has been published, and the vendor has not provided any response or mitigation advice.

Sensitive authentication settings are stored in cleartext on disk, which could allow an attacker with access to the file system or backups to obtain credentials or other sensitive data. Since the vulnerability can be triggered remotely without authentication or user interaction, it increases the risk of unauthorized data exposure. However, there is no indication of privilege escalation or direct code execution. The CVSS 4.0 base score is 5.3, reflecting a medium severity impact primarily due to confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to files storing authentication settings and monitor for any updates from the vendor. Avoid exposing the affected endpoint to untrusted networks until a fix is released.