langflow-ai langflow
42 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-105741 | >= 1.5.0, < 1.10.3 | Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write | HIGH 7.1 | 0.2 % | ||
| CVE-2026-105740 | < 1.9.0 | Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server | CRITICAL 9.9 | 1.0 % | ||
| CVE-2026-105699 | >= 1.6.8, <= 1.9.0 | Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers | HIGH 7.1 | 0.3 % | ||
| CVE-2026-105698 | >= 1.0.0, < 1.10.1 | Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-105697 | >= 1.1.2, < 1.10.3 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-101861 | 1.0.16 – < 1.12.0 ; 0.0.94 – < 1.12.0 | Langflow Code Execution via eval() in Component Input Schema | LOW 2.1 | 0.2 % | ||
| CVE-2026-48520 | < 1.10.0 | Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-33760 | < 1.9.0 | Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints | HIGH 8.8 | 0.5 % | ||
| CVE-2026-42867 | < 1.9.0 | Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-55255 | < 1.9.1 | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | HIGH 8.4 | 0.9 % | KEV | |
| CVE-2026-55423 | < 1.7.0 | Langflow: Logout button does not clear session | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-55446 | < 1.0.19 | Langflow: Unauthenticated DoS through multipart form boundary file upload | HIGH 7.5 | 0.6 % | ||
| CVE-2026-48519 | < 1.9.2 | Langflow: Unauthenticated RCE in Shareable Playgrounds | CRITICAL 9.6 | 0.8 % | ||
| CVE-2026-55447 | < 1.9.2 | Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit | CRITICAL 9.6 | 0.7 % | ||
| CVE-2026-55450 | < 1.9.1 | Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak | CRITICAL 9.3 | 1.2 % | ||
| CVE-2026-12822 | 1.9.0 ; 1.9.1 ; 1.9.2 ; … | langflow-ai langflow Bundle URL Loader code injection | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-42048 | < 1.9.0 | Langflow: Path Traversal in Langflow Knowledge Bases API | CRITICAL 9.6 | 4.2 % | ||
| CVE-2026-7700 | 1.10.0 ; 1.10.1 ; 1.10.2 | langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-7687 | 1.8.0 ; 1.8.1 ; 1.8.2 ; … | langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection | MEDIUM 5.3 | 3.0 % | ||
| CVE-2026-6600 | 1.8.0 ; 1.8.1 ; 1.8.2 ; … | langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-6599 | 1.8.0 ; 1.8.1 ; 1.8.2 ; … | langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-6598 | 1.8.0 ; 1.8.1 ; 1.8.2 ; … | langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-6597 | 1.8.0 ; 1.8.1 ; 1.8.2 ; … | langflow-ai langflow Flow Using API core.py has_api_terms credentials storage | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-6596 | 1.0 ; 1.1.0 | langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-34046 | < 1.5.1 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check | HIGH 8.7 | 0.5 % | ||
| CVE-2026-33873 | < 1.9.0 | Langflow has Authenticated Code Execution in Agentic Assistant Validation | CRITICAL 9.3 | 1.5 % | ||
| CVE-2026-5027 | | Langflow - Path Traversal Arbitrary File Write via upload_user_file | HIGH 8.8 | 40 % | ||
| CVE-2026-5026 | | Langflow - Stored XSS via Malicious SVG Upload | HIGH 7.0 | 0.2 % | ||
| CVE-2026-5025 | | Langflow - Application Logs Exposed to All Authenticated Users | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-5022 | | Langflow - Missing Authorization on download_image Endpoint | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-33497 | < 1.7.1 | Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading | HIGH 8.7 | 20 % | ||
| CVE-2026-33484 | >= 1.0.0, < 1.9.0 | Langflow has Unauthenticated IDOR on Image Downloads | HIGH 7.5 | 5.9 % | ||
| CVE-2026-33475 | < 1.9.0 | Langflow GitHub Actions Shell Injection | CRITICAL 9.1 | 3.2 % | ||
| CVE-2026-33309 | >= 1.2.0, < 1.9.0 | Langflow has an Arbitrary File Write (RCE) via v2 API | CRITICAL 10.0 | 13 % | ||
| CVE-2026-33053 | < 1.9.0 | Langflow has Missing Ownership Verification in API Key Deletion (IDOR) | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-33017 | < 1.9.0 | Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint | CRITICAL 9.3 | 96 % | KEV | |
| CVE-2026-27966 | < 1.8.0 | Langflow has Remote Code Execution in CSV Agent | CRITICAL 9.8 | 35 % | ||
| CVE-2026-21445 | < 1.7.0.dev45 | Langflow Missing Authentication on Critical API Endpoints | HIGH 8.8 | 33 % | ||
| CVE-2025-68478 | < 1.7.0 | Langflow Vulnerable to External Control of File Name or Path | HIGH 7.1 | 5.8 % | ||
| CVE-2025-68477 | < 1.7.0 | Langflow vulnerable to Server-Side Request Forgery | HIGH 7.7 | 6.3 % | ||
| CVE-2025-57760 | <= 1.5.0 | Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation | HIGH 8.8 | 0.5 % | ||
| CVE-2025-3248 | < 1.3.0 | Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code | CRITICAL 9.8 | 100 % | KEV |