Kolega-Ai-Dev

Langflow uses a weak and reversible key derivation mechanism for encryption at rest, which could lead to the disclosure of all stored credentials.

An authorization bypass exists in the middleware layer `kubeClientMiddleware` within the `api/http/handler/kubernetes/handler.go` file. The middleware validates user tokens before forwarding traffic to Kubernetes clusters; however, when the `security.RetrieveTokenData()` function returns an error, the system writes an HTTP 403 response but fails to stop execution. This allows the request to proceed to the handler with a nil `tokenData` value, bypassing authorization checks. An attacker with a valid Portainer session can use this flaw to read or modify Kubernetes resources, such as pods, secrets, config maps, and deployments, on target endpoints that their role should not permit. This could potentially lead to lateral movement if sensitive credentials are recovered from Kubernetes secrets.

The backup restore feature accepts a `.tar.gz` archive and extracts it to a target directory on the server. The extraction function `ExtractTarGz()` in `api/archive/targz.go` constructs output paths using `filepath.Clean(filepath.Join(outputDirPath, header.Name))`, which fails to prevent directory traversal. A crafted archive containing entries such as `../../etc/cron.d/evil` can resolve to paths outside the extraction root, allowing an attacker with administrator access to write files to arbitrary locations on the server filesystem. This can lead to arbitrary file writes at any path accessible to the Portainer process and potential host persistence by writing to cron directories, SSH authorized key files, or executable paths.

The software uses a weak hardcoded default value 'Secre$t' for the `TOKEN HASH SECRET` environment variable in the `packages/server/src/enterprise/utils/tempTokenUtils.ts` file when the variable is not configured. This secret is used to derive an AES-256-CBC (Advanced Encryption Standard with Cipher Block Chaining) key to encrypt user IDs and workspace IDs within the 'meta' field of JWT (JSON Web Tokens). An attacker aware of the default secret can decrypt this metadata to extract internal identifiers or re-encrypt manipulated values. While the JWT signature is validated separately, the disclosure and manipulation of this metadata could facilitate unauthorized data access or privilege escalation.

The enterprise passport authentication middleware in `packages/server/src/enterprise/middleware/passport/index.ts` uses weak hardcoded default values for JWT secrets (`auth token`, `refresh token`) and audience/issuer values (`AUDIENCE`, `ISSUER`). If the environment variables `JWT AUTH TOKEN SECRET`, `JWT REFRESH TOKEN SECRET`, `JWT AUDIENCE`, and `JWT ISSUER` are not configured, the application silently falls back to these publicly known defaults. This allows an unauthenticated attacker to forge valid JSON Web Tokens (JWT) and impersonate any user, including administrators, leading to a complete authentication bypass and full takeover of the instance.

The software uses a weak hardcoded default secret ('flowise') for the express-session middleware when the `EXPRESS SESSION SECRET` environment variable is not set. Since this secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Langflow is a tool for building and deploying AI-powered agents and workflows. The `delete api key route()` endpoint, which accepts the `api key id` path parameter, performs only a generic authentication check. The `delete api key()` function does not verify if the API key belongs to the current user before deleting it. This allows an authenticated attacker to enumerate and delete API keys belonging to other users by guessing or discovering their API key IDs, potentially leading to account takeover, denial of service, and disruption of integrations. The vulnerable code is located in src/backend/base/langflow/api/v1/api key.py lines 44-53. The `delete api key()` function in crud.py lines 44-49 retrieves the API key by ID and deletes it without checking ownership.

The software uses bcrypt with a default salt round value of 5, resulting in only 32 iterations. This is significantly lower than the OWASP-recommended minimum of 10 rounds (1024 iterations). This cryptographic weakness allows attackers using modern GPU hardware to crack password hashes approximately 30 times faster in the event of a database breach, potentially compromising all user accounts. The issue is present in the `getHash()` function and the `resetPassword` process.

A Server-Side Request Forgery (SSRF) issue exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. The initial metadata request executes without validation, allowing limited outbound requests to arbitrary URLs before SSRF controls are applied. The `uploadViaURL()` function uses `axios.head()` to retrieve metadata without SSRF filtering. This request is performed before SSRF protections are enforced. The impact is limited as only `HEAD` requests are affected, and no direct exfiltration of response data occurs. However, it may allow blind SSRF via outbound `HEAD` requests, limited internal service probing, and interaction with sensitive internal endpoints that respond to `HEAD` requests. The issue does not provide arbitrary data access or full internal network compromise on its own. A proof of concept involves sending a POST request to the `/api/v2/storage/upload-by-url` endpoint with a malicious URL in the `url` parameter.