langflow-ai langflow-base
3 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-105698 | < 0.10.1 | Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-105697 | >= 0.1.2, < 0.10.3 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-34046 | < 0.5.1 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check | HIGH 8.7 | 0.5 % |