Langflow
Vulnerabilities in Langflow, the open-source visual LLM-workflow builder — unauthenticated code-execution flaws, IDORs, and CORS bugs that keep landing on CISA's Known Exploited Vulnerabilities catalog as public-facing deployments get hit.
Langflow Unauthenticated RCE via Code Execution Endpoint
An unauthenticated remote code execution flaw in Langflow allows attackers to run arbitrary Python code on exposed instances, enabling theft of AI API keys and cloud credentials.
Langflow /api/v1/responses IDOR — cross-user flow execution
An authenticated IDOR in Langflow's /api/v1/responses endpoint lets a logged-in attacker execute any other user's flow by passing the victim's flow UUID. NVD scores it 8.4 high; the vendor GHSA calls it 9.9 critical. Fixed in Langflow 1.9.1. Added to CISA KEV on 2026-07-07.
Langflow public flow build endpoint allows unauthenticated RCE
Langflow < 1.9.0: public flow build endpoint accepts attacker-supplied Python code passed to exec() with no sandboxing — unauthenticated RCE. CVSS 9.8 critical.
Langflow validate-endpoint exec_globals RCE (unauthenticated)
Unauthenticated RCE in Langflow's /api/v1/validate endpoint via the exec_globals parameter. CISA added to KEV on 2026-07-21 with a federal patch deadline of 2026-07-24.
Langflow CORS misconfiguration enables CSRF-driven token theft and RCE
Langflow ≤ 1.6.9: permissive CORS and SameSite=None cookies enable CSRF token theft, giving attackers RCE via authenticated endpoints. CVSS 8.8 high. CISA KEV 2026-05-21.
Langflow unauthenticated code injection in validate/code endpoint
Langflow < 1.3.0: unauthenticated code injection allows RCE via crafted HTTP requests to /api/v1/validate/code. CVSS 9.8 critical. CISA KEV 2025-05-05.
Public PoC Lands for Langflow's 9.8 Unauth RCE — Patch to 1.10.1 Now
CVE-2026-9198 lets an unauthenticated network caller reach full remote code execution on default Langflow deployments. It's on CISA's KEV list, it's exploited, and a public proof-of-concept is now out.
Langflow's fifth KEV entry: CVE-2026-0770, patch by Friday
CISA added Langflow's unauthenticated RCE flaw CVE-2026-0770 to KEV on 2026-07-21 with a federal deadline of 2026-07-24. Fifth Langflow entry on the catalog in fourteen months — upgrade past 1.7.3.