Description Summary:
A security flaw has been discovered in langflow-ai langflow that may expose the system to unauthorized operations.

Executive Summary:
A high-severity security vulnerability in the langflow-ai langflow platform could allow attackers to compromise system security.

Vulnerability Details

CVE-ID: CVE-2026-6596

Affected Software: langflow-ai langflow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to a flaw within the langflow platform's processing engine. The specific entry point and authentication prerequisites are currently being evaluated by the vendor security team.

Business Impact

A CVSS score of 7.3 indicates a High risk. Successful exploitation could lead to the unauthorized execution of workflows, potential data exfiltration, or total compromise of the application, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update langflow to the most recent stable release provided by the vendor to remediate the underlying flaw.

Proactive Monitoring: Review application-level logs for suspicious workflow execution requests or unauthorized access attempts to the platform dashboard.

Compensating Controls: Deploy the application behind a secure proxy with strict authentication controls and restrict access to the administration interface to trusted internal networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Organizations utilizing langflow-ai langflow must verify their current version and apply the necessary patches. Continued reliance on unpatched software increases the probability of a successful security breach.

Description Summary:
Unauthenticated users can exploit Langflow to cause server-side space exhaustion via excessive file uploads and gain information leaks regarding file system paths.

Executive Summary:
An unauthenticated vulnerability in Langflow allows attackers to trigger server-side storage exhaustion and obtain sensitive file path information, facilitating further attacks.

Vulnerability Details

CVE-ID: CVE-2026-55450

Affected Software: langflow-ai langflow

Affected Versions: Prior to 1.9.1

Vulnerability: The application fails to implement proper authentication and rate limiting for file uploads, allowing unauthenticated attackers to flood the server with data. Furthermore, the application exposes the absolute file paths in its responses, providing attackers with critical reconnaissance data.

Business Impact

With a CVSS score of 9.3, this vulnerability represents a severe threat to service availability and system security. The combination of resource exhaustion (Denial of Service) and information disclosure creates an ideal environment for attackers to crash the service or chain this flaw into more complex exploits.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.1 or later to implement necessary authentication checks and restrict file upload behavior.

Proactive Monitoring: Monitor disk usage and incoming request rates to identify potential DoS attempts or anomalous upload activity.

Compensating Controls: Implement strict network access control lists (ACLs) to ensure the Langflow interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous because it does not require authentication, making it trivial for remote attackers to disrupt services or gather reconnaissance. Organizations should verify that their Langflow instances are not exposed to untrusted networks and apply the 1.9.1 update as the highest priority.

Description Summary:
A path traversal vulnerability in Langflow components based on BaseFileComponent allows attackers to read arbitrary files from the server's filesystem via manipulated RAG input files.

Executive Summary:
Langflow versions prior to 1.9.2 are vulnerable to arbitrary file read attacks, allowing unauthorized access to sensitive system files via malicious RAG components.

Vulnerability Details

CVE-ID: CVE-2026-55447

Affected Software: Langflow Langflow

Affected Versions: Prior to 1.9.2

Vulnerability: The vulnerability affects multiple RAG-related components, such as Docling and various file readers. By providing a malicious path within an input file, an attacker can trick the system into reading sensitive files from the server's filesystem using an absolute path.

Business Impact

This vulnerability could result in the total disclosure of sensitive configuration files, environment variables, or system credentials stored on the application server. With a CVSS score of 9.6, the potential for full system compromise via credential harvesting or configuration exposure is severe.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.2 or later to apply the necessary filesystem access restrictions.

Proactive Monitoring: Monitor filesystem access logs for unexpected read attempts outside of intended directories and audit the contents of uploaded RAG data.

Compensating Controls: Ensure the Langflow application is running within a containerized environment with minimal filesystem privileges to limit the impact of potential traversal attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of arbitrary file reading requires immediate attention to protect sensitive system data. Administrators should deploy version 1.9.2 and conduct a thorough audit of any previously processed RAG data to ensure no compromise has already occurred.

Description Summary:
An Insecure Direct Object Reference (IDOR) vulnerability in the Langflow /api/v1/responses endpoint allows authenticated attackers to execute unauthorized AI flows belonging to other users.

Executive Summary:
Langflow prior to version 1.9.2 contains a critical IDOR vulnerability that permits authenticated users to execute arbitrary AI workflows belonging to other accounts.

Vulnerability Details

CVE-ID: CVE-2026-55255

Affected Software: Langflow Langflow

Affected Versions: Prior to 1.9.2

Vulnerability: The vulnerability exists in the /api/v1/responses endpoint, where insufficient authorization checks allow an authenticated attacker to manipulate flow IDs. By supplying a victim's flow ID, an attacker can bypass access controls and trigger execution of workflows they do not own.

Business Impact

This flaw poses a significant risk to data integrity and confidentiality, as attackers can trigger unauthorized workflows, potentially leaking sensitive information or manipulating AI agent outputs. With a CVSS score of 9.9, this vulnerability could be exploited to cause widespread service abuse and cross-tenant data compromise.

Remediation Plan

Immediate Action: Upgrade all Langflow instances to version 1.9.2 or later immediately.

Proactive Monitoring: Review API access logs for suspicious requests to the /api/v1/responses endpoint, specifically looking for pattern deviations in flow ID requests.

Compensating Controls: Implement strict API gateway authentication and authorization policies to validate user ownership of resources before allowing workflow execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on Langflow for automated agent orchestration must apply the 1.9.2 patch immediately. The ability to execute arbitrary flows represents a major security breach point that must be remediated to ensure the integrity of the AI deployment environment.

Description Summary:
The 'POST /api/v2/files' endpoint fails to sanitize the 'filename' parameter, allowing unauthenticated path traversal and arbitrary file writes.

Executive Summary:
An unauthenticated path traversal vulnerability in the /api/v2/files endpoint allows attackers to write files to arbitrary locations on the filesystem, potentially leading to system takeover.

Vulnerability Details

CVE-ID: CVE-2026-5027

Affected Software: The affected software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application's file upload API does not sanitize the filename parameter within multipart form data. An unauthenticated attacker can use path traversal sequences (e.g., ../) to bypass the intended upload directory and write files anywhere the application has permissions.

Business Impact

This vulnerability is high-severity (CVSS 8.8) because it can be used to overwrite critical system files or upload a web shell into a web-accessible directory. This leads directly to remote code execution and full system compromise.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately. If no update is available, implement strict input validation on the filename parameter to strip path traversal sequences.

Proactive Monitoring: Monitor the filesystem for the creation of unexpected files, especially in system or web-root directories, and audit logs for POST requests to /api/v2/files containing ../ sequences.

Compensating Controls: Ensure the application process runs with the least privilege necessary, preventing it from writing to sensitive system directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, no public exploitation has been reported. Path traversal in upload endpoints is a common and highly reliable attack vector for gaining initial access.

Analyst Recommendation

The ability to write arbitrary files to a server is a critical security failure. Administrators must prioritize the application of patches for this API service and verify that the fix correctly handles all variants of path traversal characters.

Description Summary:
Langflow contains a critical remote code execution (RCE) vulnerability in its "Shareable Playground" feature, allowing unauthenticated users to execute arbitrary Python code.

Executive Summary:
A critical remote code execution vulnerability in Langflow allows unauthenticated attackers to execute arbitrary Python code via the Shareable Playground feature.

Vulnerability Details

CVE-ID: CVE-2026-48519

Affected Software: Langflow

Affected Versions: Prior to 1.9.2

Vulnerability: The vulnerability resides in the /api/v1/build_public_tmp endpoint, which fails to sanitize input within the node template code. Unauthenticated attackers can inject and execute arbitrary Python code by manipulating the JSON payload, leading to full system compromise.

Business Impact

This vulnerability carries a CVSS score of 9.6, reflecting the ability for an attacker to achieve full server-side execution. A successful exploit grants the attacker complete control over the host environment, risking sensitive data exposure, lateral movement within the network, and total system disruption.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.2 or later immediately to address the insecure code execution path.

Proactive Monitoring: Inspect server logs for unusual inbound traffic to the /api/v1/build_public_tmp route and monitor for anomalous child processes spawned by the Langflow service.

Compensating Controls: Disable the "Shareable Playground" or "Public Flows" feature if it is not business-critical until the update can be applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this RCE vulnerability necessitates immediate patching. Organizations utilizing Langflow must treat this as a high-priority incident, ensuring the update is applied to all instances exposed to the network to prevent catastrophic system compromise.

Description Summary:
Langflow is vulnerable to Path Traversal in the Knowledge Bases API, allowing authenticated attackers to delete arbitrary directories on the server.

Executive Summary:
A critical path traversal vulnerability in Langflow allows authenticated attackers to perform arbitrary file/directory deletion, threatening system integrity.

Vulnerability Details

CVE-ID: CVE-2026-42048

Affected Software: Langflow

Affected Versions: < 1.9.0

Vulnerability: The vulnerability exists in the Knowledge Bases API (DELETE /api/v1/knowledge_bases) where user-supplied input is not sanitized, allowing an authenticated attacker to execute path traversal and delete arbitrary directories.

Business Impact

This vulnerability carries a CVSS score of 9.6, reflecting the high impact on system availability and data integrity. An attacker can leverage this to delete critical system files, leading to a complete service disruption (Denial of Service) or the destruction of essential application data, resulting in significant operational downtime.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.0 or later immediately to patch the Knowledge Bases API.

Proactive Monitoring: Monitor API access logs for suspicious DELETE requests targeting unauthorized paths or directory structures outside the intended knowledge base repository.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and block requests containing path traversal sequences (e.g., "../") directed at the /api/v1/knowledge_bases endpoint.

Exploitation Status

Public Exploit Available: Yes (PoC)

Analyst Notes: While there is currently no evidence of active, widespread exploitation, the existence of a Proof-of-Concept (PoC) significantly increases the risk of imminent attacks.

Analyst Recommendation

Due to the availability of a Proof-of-Concept and the potential for severe operational impact, organizations running Langflow must prioritize updating to version 1.9.0. Ensure that API access is strictly controlled and that all instances are accounted for in the update cycle.

Description Summary:
Langflow contains a critical vulnerability related to the deployment of AI-powered agents and workflows that may allow for unauthorized system interaction.

Executive Summary:
A high-severity vulnerability in Langflow poses a significant risk to the integrity and confidentiality of AI-powered agent workflows and underlying system resources.

Vulnerability Details

CVE-ID: CVE-2026-33760

Affected Software: Langflow Langflow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the insecure handling of AI workflow configurations, potentially allowing an attacker to manipulate agent behavior or access restricted system resources. Authentication requirements remain dependent on specific deployment configurations, but the flaw typically impacts the integrity of the workflow execution environment.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized execution of AI-driven commands, potentially resulting in data exfiltration or the poisoning of automated business processes. With a CVSS score of 8.8, this flaw represents a high risk to organizational security, as it directly targets the core functionality of the Langflow platform.

Remediation Plan

Immediate Action: Audit the Langflow deployment for vendor-supplied security patches and apply them immediately to the affected environment.

Proactive Monitoring: Monitor application access logs and workflow execution logs for anomalous patterns, specifically looking for unauthorized configuration changes or unexpected agent activity.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential impact of an agent that may have been compromised or manipulated via this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the increasing integration of AI workflows in production environments, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations should treat this vulnerability with urgency. Prioritize the identification of all Langflow instances within your infrastructure and apply the latest vendor updates to close this security gap and prevent potential unauthorized agent manipulation.

Description Summary:
An improper access control vulnerability in the Langflow image file endpoint allows unauthenticated attackers to download sensitive user-uploaded images by guessing or discovering flow IDs.

Executive Summary:
A critical authorization bypass vulnerability in Langflow allows unauthenticated attackers to access and download private user images, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-33484

Affected Software: Langflow Langflow

Affected Versions: 1.0.0 through 1.8.1

Vulnerability: The /api/v1/files/images/{flow_id}/{file_name} endpoint fails to perform authentication or ownership checks on requested files. This allows any unauthenticated attacker to retrieve sensitive images by providing a valid flow ID and file name.

Business Impact

This vulnerability enables unauthorized access to potentially sensitive or proprietary data stored within Langflow workflows. Given the CVSS score of 7.5, the risk to confidentiality is high, particularly in multi-tenant environments where an attacker can systematically scrape data from other users. Successful exploitation could lead to significant data breaches and a loss of trust in the platform.

Remediation Plan

Immediate Action: Update the Langflow package to version 1.9.0 or later to implement the necessary authentication and authorization checks.

Proactive Monitoring: Review API access logs for anomalous patterns, specifically looking for high volumes of unauthorized requests to the image retrieval endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/v1/files/images/ path, ensuring only authorized traffic can reach the endpoint until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 26, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently easy to exploit because it requires no credentials and targets a predictable URL structure.

Analyst Recommendation

The vulnerability represents a direct threat to data privacy due to the lack of access controls on the image API. Organizations currently running versions 1.0.0 through 1.8.1 must prioritize upgrading to version 1.9.0 immediately. If an immediate upgrade is not feasible, administrators should restrict network access to the affected endpoint to prevent unauthorized data exfiltration.

Description Summary:
Unauthenticated remote shell injection in Langflow's GitHub Actions workflows allows attackers to execute arbitrary commands and exfiltrate CI secrets via malicious branch names.

Executive Summary:
Langflow is vulnerable to unauthenticated remote shell injection in its CI/CD pipelines, allowing attackers to steal sensitive secrets and compromise the software supply chain.

Vulnerability Details

CVE-ID: CVE-2026-33475

Affected Software: Langflow

Affected Versions: Prior to version 1.9.0

Vulnerability: This is a shell injection vulnerability in GitHub Actions workflows. It occurs because unsanitized GitHub context variables (like github.head_ref) are directly interpolated into run: shell commands, allowing an unauthenticated attacker to execute commands by submitting a pull request with a malicious branch name.

Business Impact

An attacker can exfiltrate sensitive CI secrets, such as GITHUB_TOKEN, and potentially push malicious code or images to production repositories. This could lead to a massive supply chain compromise affecting all users of the Langflow product. The CVSS score of 9.1 reflects the critical risk to the integrity of the development lifecycle.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.0 or later, which refactors workflows to use environment variables instead of direct interpolation.

Proactive Monitoring: Audit GitHub Actions logs for suspicious activity, such as unusual curl commands or unauthorized access to secrets in workflows triggered by external forks.

Compensating Controls: Restrict GitHub Actions permissions and require manual approval for all workflows triggered by pull requests from external contributors.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 24, 2026, a proof-of-concept (PoC) is publicly available demonstrating how to exfiltrate secrets via a malicious branch name. Active exploitation is highly likely given the public nature of the PoC.

Analyst Recommendation

This is a critical supply chain vulnerability. We strongly recommend that all organizations using Langflow immediately update to version 1.9.0 and rotate any secrets that may have been exposed in their CI/CD environments.

Description Summary:
Langflow contains an arbitrary file write vulnerability in the /api/v2/files/ endpoint, allowing authenticated attackers to achieve remote code execution.

Executive Summary:
An arbitrary file write vulnerability in Langflow allows authenticated attackers to perform remote code execution by bypassing existing filename validation.

Vulnerability Details

CVE-ID: CVE-2026-33309

Affected Software: Langflow

Affected Versions: 1.2.0 through 1.8.1

Vulnerability: The vulnerability exists due to a failure in boundary containment within the LocalStorageService component. Authenticated attackers can bypass path-parameter guards during multipart file uploads to the POST /api/v2/files/ endpoint to write files to the host system.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a catastrophic risk to server integrity. An attacker who gains access to the application can write malicious scripts to the filesystem, resulting in full server compromise, unauthorized access to AI workflows, and potential lateral movement within the environment.

Remediation Plan

Immediate Action: Upgrade Langflow to version 1.9.0 or higher to resolve the architectural flaw in the file storage service.

Proactive Monitoring: Review web server logs for suspicious file upload activity, particularly requests directed at the /api/v2/files/ endpoint involving unusual file extensions.

Compensating Controls: Implement strict network ingress filtering to limit access to the Langflow management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The CVSS score of 9.9 highlights the extreme danger posed by this RCE vulnerability. Organizations currently utilizing Langflow versions 1.2.0 through 1.8.1 must treat this as a high-priority update to prevent total system takeover.

Description Summary:
Langflow versions prior to 1.9.0 are vulnerable to an authorization bypass allowing authenticated users to delete API keys belonging to other users.

Executive Summary:
A critical authorization bypass vulnerability in Langflow allows authenticated attackers to delete arbitrary API keys, leading to potential service disruption and loss of access control.

Vulnerability Details

CVE-ID: CVE-2026-33053

Affected Software: Langflow

Affected Versions: < 1.9.0

Vulnerability: The application fails to perform proper ownership validation within the delete_api_key_route endpoint, allowing any authenticated user to trigger the deletion of API keys owned by other users.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high potential for operational disruption. Successful exploitation allows an attacker to invalidate the API credentials of other users or administrators, resulting in unauthorized service downtime and a significant compromise of the application workflow integrity.

Remediation Plan

Immediate Action: Update the Langflow package to version 1.9.0 or later immediately to incorporate the required ownership checks.

Proactive Monitoring: Review application access logs for unusual patterns of API key deletion requests, particularly those originating from non-administrative user accounts.

Compensating Controls: Implement strict API gateway controls or network-level access restrictions to limit the exposure of the management endpoints to authorized personnel only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently known to be exploited, the ability for a low privileged user to perform destructive actions on system components represents a significant security risk.

Analyst Recommendation

Given the high CVSS severity and the ease of exploitation once an attacker has authenticated access, organizations should prioritize upgrading their Langflow environment to version 1.9.0. Failing to patch this vulnerability leaves the platform exposed to unauthorized administrative actions that could result in widespread service failure.

Description Summary:
Langflow versions prior to 1.9.0 are susceptible to unauthenticated remote code execution because the build_public_tmp endpoint improperly executes attacker-supplied Python code in node definitions.

Executive Summary:
A critical remote code execution vulnerability in Langflow is currently being actively exploited in the wild, posing an immediate risk to all unpatched instances.

Vulnerability Details

CVE-ID: CVE-2026-33017

Affected Software: Langflow Langflow

Affected Versions: < 1.9.0

Vulnerability: This vulnerability occurs in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows unauthenticated attackers to supply arbitrary Python code within the data parameter. This input is processed by the exec() function without sandboxing, leading to full remote code execution on the underlying host.

Business Impact

The CVSS score of 9.5 reflects the critical severity of this flaw, as it allows complete system compromise without requiring any user credentials. Successful exploitation could lead to full unauthorized access to the host environment, data exfiltration, or the deployment of persistent malware, resulting in significant operational downtime and potential loss of sensitive intellectual property or customer data.

Remediation Plan

Immediate Action: Upgrade Langflow to version 1.9.0 or later immediately to incorporate the necessary input sanitization and logic changes.

Proactive Monitoring: Monitor server logs for suspicious POST requests to the /api/v1/build_public_tmp/ endpoint, specifically looking for payloads containing Python syntax or unusual data structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and block malicious input containing Python keywords or code injection patterns in API requests.

Exploitation Status

Public Exploit Available: Yes, a weaponized exploit exists (a Metasploit module and ExploitDB entry are available).

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of March 25, 2026. The high EPSS score and confirmed inclusion in the CISA KEV catalog indicate that this is a high-priority target for threat actors, and the existence of multiple public Proof-of-Concept repositories further lowers the barrier for exploitation.

Analyst Recommendation

Given the confirmed active exploitation and the availability of weaponized exploit code, this vulnerability represents an extreme risk to organizational security. Administrators must prioritize the deployment of version 1.9.0 immediately. If an immediate update is not feasible, the affected endpoint should be restricted or disabled to prevent unauthorized remote execution.

Description Summary:
Langflow's CSV Agent node improperly enables dangerous code execution by default, allowing unauthenticated attackers to achieve remote code execution via prompt injection.

Executive Summary:
The hardcoded enablement of dangerous code execution in Langflow's CSV Agent node allows unauthenticated attackers to execute arbitrary commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-27966

Affected Software: Langflow

Affected Versions: Prior to version 1.8.0

Vulnerability: The CSV Agent node in Langflow hardcodes the allow_dangerous_code parameter to True, which exposes LangChain’s Python REPL tool. An unauthenticated attacker can leverage prompt injection to execute arbitrary Python and operating system commands.

Business Impact

A successful exploit results in full Remote Code Execution (RCE) on the underlying server, potentially leading to complete system takeover. Attackers could steal proprietary AI models, access sensitive datasets, or use the server as a pivot point for lateral movement within the corporate network. The CVSS score of 9.8 reflects the critical nature of this unauthenticated execution flaw.

Remediation Plan

Immediate Action: Upgrade Langflow to version 1.8.0 or later, which disables the dangerous default configuration.

Proactive Monitoring: Audit Langflow logs for suspicious prompt patterns or unexpected Python execution errors within the CSV Agent node.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block prompt injection patterns aimed at LLM-integrated tools.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation of this vulnerability. Given the increasing prevalence of prompt injection attacks against AI frameworks, exploitation is likely if systems remain unpatched.

Analyst Recommendation

The exposure of a Python REPL tool to unauthenticated input constitutes a severe security failure. Organizations utilizing Langflow must prioritize the update to version 1.8.0 to mitigate the risk of full server compromise and data exfiltration.

Description Summary:
Langflow versions prior to 1.7.0 are vulnerable to arbitrary file creation and overwriting due to improper path validation in the fs_path parameter, allowing authenticated users to write files anywhere.

Executive Summary:
Langflow versions prior to 1.7.0 are susceptible to an arbitrary file write vulnerability that allows authenticated attackers to overwrite critical system files.

Vulnerability Details

CVE-ID: CVE-2025-68478

Affected Software: Langflow

Affected Versions: < 1.7.0

Vulnerability: This vulnerability is a path traversal and arbitrary file write flaw (CWE-73) where the application fails to normalize or restrict the fs_path parameter in the request body. An authenticated attacker can supply an absolute path to overwrite or create files on the underlying filesystem with the privileges of the Langflow service.

Business Impact

The ability to write or overwrite arbitrary files on the host system presents a severe risk of system compromise. An attacker could potentially overwrite configuration files, inject malicious scripts, or modify system binaries to achieve remote code execution, leading to full server takeover and data integrity loss. Given the CVSS score of 7.1, this vulnerability is classified as High severity and requires immediate remediation to prevent unauthorized system manipulation.

Remediation Plan

Immediate Action: Update the Langflow installation to version 1.7.1 or later immediately to incorporate the required path normalization and security controls.

Proactive Monitoring: Review application access logs for unusual requests containing absolute file paths in the fs_path parameter. Monitor the filesystem for unauthorized file modifications or the creation of unexpected files in sensitive directories.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block incoming requests containing path traversal sequences or absolute path references in request bodies. Ensure the Langflow service runs with the least privilege necessary to minimize the impact of a successful file write.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization on the file path parameter.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of the host server due to the potential for arbitrary file overwriting. Security teams must prioritize upgrading to version 1.7.1 as soon as possible. In environments where immediate patching is not feasible, ensure that the application is isolated and that strictly defined file permissions are enforced to limit the potential damage of a successful exploit.

Description Summary:
Langflow versions prior to 1.7.0 are susceptible to server-side request forgery (SSRF) via the API Request component, allowing authenticated users to access internal network resources.

Executive Summary:
A critical server-side request forgery vulnerability in Langflow allows authenticated attackers to access sensitive internal network services and cloud metadata.

Vulnerability Details

CVE-ID: CVE-2025-68477

Affected Software: Langflow

Affected Versions: < 1.7.0

Vulnerability: The vulnerability exists in the API Request component, which fails to adequately validate or restrict URLs supplied by authenticated users. This allows an attacker to force the server to perform requests against private IP ranges and cloud metadata services, returning the response body to the caller.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational data and infrastructure. By bypassing network segmentation, an attacker can exfiltrate sensitive information from internal databases, administrative panels, or cloud environment metadata. Given the CVSS score of 7.7, this is a high-severity issue that could provide a critical foothold for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Update the Langflow installation to version 1.7.1 or later to implement the necessary request validation logic.

Proactive Monitoring: Review API access logs for suspicious requests directed toward private IP addresses, such as 127.0.0.1 or 169.254.169.254, which are common indicators of SSRF attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block outbound requests from the application server toward restricted internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it transforms an authorized API interaction into a powerful tool for internal network reconnaissance.

Analyst Recommendation

The ability for an authenticated user to perform SSRF against internal infrastructure represents a significant security oversight. Organizations utilizing Langflow must prioritize the update to version 1.7.1 immediately to close this access vector. Failure to patch leaves the internal network exposed to unauthorized information disclosure and potential service compromise.

Description Summary:
A privilege escalation vulnerability in Langflow allows authenticated users with Remote Code Execution capabilities to create administrative superuser accounts.

Executive Summary:
A critical privilege escalation vulnerability in Langflow allows authenticated users to gain full administrative control, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-57760

Affected Software: Langflow

Affected Versions: <= 1.5.0

Vulnerability: This vulnerability, categorized as Improper Privilege Management (CWE-269), occurs when an authenticated user leverages existing Remote Code Execution access to invoke the internal CLI command langflow superuser. This action permits the creation of a new administrative account, granting full superuser privileges regardless of the user's original account status.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve full administrative control over the Langflow instance. This can lead to total compromise of sensitive AI workflows, unauthorized data access, and potential persistence within the infrastructure. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate lateral movement or data exfiltration within the organization.

Remediation Plan

Immediate Action: Update Langflow to version 1.5.1 and langflow-base to version 0.5.1 immediately to resolve the privilege escalation flaw.

Proactive Monitoring: Monitor system logs for unauthorized use of CLI commands or the creation of unexpected administrative user accounts.

Compensating Controls: Restrict network access to the Langflow instance and enforce strict access controls on the underlying container environment to prevent the initial Remote Code Execution required to trigger this flaw.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows a low-privileged account to escalate to full system control once an entry point is established.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize the deployment of the patched versions identified by the vendor to eliminate the privilege escalation vector. Failure to patch allows any user with minor execution capabilities to escalate to full administrative rights, effectively granting them complete control over the platform and its hosted AI workflows.