Langflow Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Langflow products.
Products
- Langflow15 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-55255HIGH | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1. CWE-639Jun 23, 2026 | CVSS8.4v3.1 | EPSS29.1% | PoCs1 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-55450CRITICAL | Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixe… | CVSS9.3v3.1 | EPSS11.8% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2026-5027HIGH | Langflow - Path Traversal Arbitrary File Write via upload_user_fileThe 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../'). | CVSS8.8v3.1 | EPSS31.4% | PoCs7 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2026-33497HIGH | Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file readingLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch. | CVSS8.7v4.0 | EPSS19.6% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2026-33017CRITICAL | Langflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointLangflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthe… | CVSS9.3v4.0 | EPSS96.2% | PoCs22 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2026-0772HIGH | Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution VulnerabilityLangflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the disk cache service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute … CWE-502Jan 23, 2026 | CVSS7.5v3.0 | EPSS0.897% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-0771HIGH | Langflow PythonFunction Code Injection Remote Code Execution VulnerabilityLangflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnera… CWE-94Jan 23, 2026 | CVSS7.1v3.0 | EPSS0.551% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityLangflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can le… | CVSS-v4.0 | EPSS56.9% | PoCs10 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX | |
CVE-2026-0769CRITICAL | Langflow eval_custom_component_code Eval Injection Remote Code Execution VulnerabilityLangflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this v… CWE-95Jan 23, 2026 | CVSS9.8v3.0 | EPSS33.8% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-0768CRITICAL | Langflow code Code Injection Remote Code Execution VulnerabilityLangflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerabilit… CWE-94Jan 23, 2026 | CVSS9.8v3.0 | EPSS2.04% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21445HIGH | Langflow Missing Authentication on Critical API EndpointsLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains… | CVSS8.8v4.0 | EPSS34.1% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-34291CRITICAL | Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCELangflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token… | CVSS9.4v4.0 | EPSS83.8% | PoCs2 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeLangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. | CVSS-v4.0 | EPSS>99.9% | PoCs29 | SignalsListed in CISA KEVKnown ransomware use1 Nuclei template | STIX | |
CVE-2024-9277MEDIUM | Langflow HTTP POST Request utils.py redosA vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CWE-1333Sep 27, 2024 | CVSS5.1v4.0 | EPSS0.955% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37014CRITICAL | Langflow remote code execution vulnerabilityLangflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script. | CVSS9.8v3.1 | EPSS57.5% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |