¡¾Îó²îͨ¸æ¡¿Langflow API Éí·ÝÑé֤ȱʧÎó²î(CVE-2026-21445)

Ðû²¼Ê±¼ä 2026-01-04

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Langflow API Éí·ÝÑé֤ȱʧÎó²î

CVE   ID

CVE-2026-21445

Îó²îÀàÐÍ

ÈÏÖ¤ÓëÊÚȨȱʧ

·¢Ã÷ʱ¼ä

2026-1-4

Îó²îÆÀ·Ö

8.8

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


LangflowÊÇÒ»¸ö»ùÓÚFastAPI¹¹½¨µÄ¿ªÔ´¿ò¼Ü£¬ÓÃÓÚ¼ò»¯ºÍÖÎÀí×ÔÈ»ÓïÑÔ´¦Öóͷ££¨NLP£©ÊÂÇéÁ÷µÄ¿ª·¢¡£ËüÌṩÁËÒ»Ì×Ö±¹ÛµÄAPI½Ó¿Ú£¬×ÊÖú¿ª·¢Õß¿ìËÙ¹¹½¨ºÍ°²ÅŶԻ°ÏµÍ³¡¢×Ô¶¯»¯Ê¹ÃüµÈÓ¦Óá£LangflowÖ¼ÔÚÌṩÎÞаµÄÀ©Õ¹ÐԺ͸ßЧµÄÊý¾Ý´¦Öóͷ£ÄÜÁ¦£¬ÊÊÓÃÓÚÖÖÖÖNLPÏîÄ¿£¬Ö§³ÖÓë¶à¸ö»úеѧϰģ×ÓºÍÊý¾ÝÔ´µÄ¼¯³É¡£


2026Äê1ÔÂ4ÈÕ£¬×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½Langflow±£´æ¶à¸öÒªº¦AP½Ó¿ÚȱÉÙÉí·ÝÑéÖ¤¿ØÖƵÄÎó²î£¬µ¼ÖÂδ¾­ÓÉÉí·ÝÑéÖ¤µÄÓû§Äܹ»»á¼ûÃô¸ÐµÄÓû§¶Ô»°Êý¾Ý¡¢ÉúÒâÀúÊ·¼Í¼£¬²¢Ö´ÐÐÆÆËðÐÔ²Ù×÷£¬°üÀ¨É¾³ýÐÂÎŵÈ¡£ÕâЩÎó²î·ºÆðÔÚsrc/backend/base/langflow/api/v1/monitor.pyÎļþÖеÄÈý¸öAPI½Ó¿Ú£¬ÏêϸΪ£º»ñÈ¡ÐÂÎÅ¡¢»ñÈ¡ÉúÒâ¼Í¼ºÍɾ³ý»á»°ÐÂÎÅ¡£ÓÉÓÚȱÉÙÐëÒªµÄÉí·ÝÑéÖ¤ÒÀÀµ£¨Depends(get_current_active_user)£©£¬¹¥»÷Õß¿ÉÒÔÔÚδÌṩÉí·ÝÑéÖ¤ÐÅÏ¢µÄÇéÐÎÏ»á¼ûÕâЩ½Ó¿Ú£¬´Ó¶øµ¼ÖÂÓû§Êý¾Ýй¶¡¢Òþ˽ÇÖÕ¼¼°Êý¾ÝÏú»ÙΣº¦¡£Îó²îÆÀ·Ö8.8·Ö£¬Îó²î¼¶±ð¸ßΣ¡£


¶þ¡¢Ó°Ïì¹æÄ£


Langflow <= 1.7.0


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´²¹¶¡£¬ÒÔÐÞ¸´¸ÃÎó²î¡£

Langflow > 1.7.1


ÏÂÔØÁ´½Ó£ºhttps://github.com/langflow-ai/langflow/releases/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£
ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx/
https://nvd.nist.gov/vuln/detail/CVE-2026-21445