CVE-2026-55446
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile — higher than 23% of all known CVEs
Summary
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.0.19, an attacker could send a /api/v1/files/upload/ request without an authentication token/cookies, leading to the langflow app becoming unusable for all users for an indefinite amount of time.
Risk Assessment
This vulnerability can lead to complete application downtime, affecting service availability for users. Organizations may experience outages and loss of productivity.
Recommendation
It is recommended to upgrade to version 1.0.19 or later to mitigate this vulnerability. Additionally, implementing monitoring and rate-limiting mechanisms for API requests is advisable.
Original NVD description (English source)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.