Disclosed weakness · no CVE recorded

Langflow provider validation could use a server key with an unintended destination

Langflow · Langflow

First documented disclosure · Review checkpoint

Summary

Checking a model-provider configuration could send a credential held by the server to an unintended destination.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The provider configuration check did not consistently enforce the allowed destination before using a server-held credential.

Conditions required

The deployment permits provider validation and uses a server-managed provider key.

Potential impact

The validation request could expose a server credential outside its intended provider boundary.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.13.2 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Restrict credential destinations and review provider-validation activity.

Operating lesson

Apply secret-destination rules to connection tests as well as production requests.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.13.2. No CVE assignment or complete affected range was established.

Sources