Actively exploited in the wild
Langflow Code Injection Vulnerability
Langflow - Langflow · Listed in the CISA KEV since 2026-03-25. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-33017
CriticalCVSS 9.8KEVSummary
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allowed building public flows without requiring authentication, leading to the possibility of remote code execution by unauthorized users.
Risk Assessment
Organizations may be exposed to remote code execution, which can lead to serious security breaches and data loss. Attackers can exploit this vulnerability to execute arbitrary code on the server.
Recommendation
It is recommended to update Langflow to version 1.9.0 or later to eliminate this vulnerability. A security audit of the application should also be conducted to identify other potential threats.
Other vulnerabilities in Langflow
See all- CVE-2026-34046High
Langflow prior to version 1.5.1 had a security vulnerability that allowed authenticated users to access other users' flows without ownership checks. The issue stemmed from the lack of proper query filtering based on the `AUTO_LOGIN` setting.
- CVE-2026-105740Critical
Langflow before 1.9.0 allows any authenticated user to achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override).
- CVE-2026-105697Critical
Langflow before 1.10.3 launches whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command. The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. With AUTO_LOGIN disabled, any authenticated (non-admin) user can exploit it.
- CVE-2026-51886Critical
Code Injection vulnerability in langflow up to 1.9.3. An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which executes code without sandboxing.
- CVE-2026-55450Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.1, unauthenticated users can upload unlimited amounts of data to the server, leading to space exhaustion. Additionally, the server response reveals the absolute path of the uploaded file, which constitutes an information leak.
- CVE-2026-55255HighActively exploited
In Langflow prior to 1.9.1, an IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
- CVE-2026-42048Critical
Langflow, a tool for building and deploying AI agents, is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases) prior to version 1.9.0. An attacker can exploit this flaw to delete arbitrary directories on the server.
- CVE-2026-0770CriticalActively exploited
A vulnerability in Langflow allows remote code execution via the exec_globals parameter in the validate endpoint. An unauthenticated attacker can inject malicious code from an untrusted source.
- CVE-2026-21445Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
- CVE-2025-34291HighActively exploited
A vulnerability in Langflow versions up to and including 1.6.9 enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie set as SameSite=None allows a malicious webpage to perform cross-origin requests with credentials and call the refresh endpoint. An attacker can obtain fresh access_token/refresh_token pairs for a victim session and use them to execute arbitrary code, leading to full system compromise.
Original NVD description (English source)
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS