Vendor
Langflow
Vulnerabilities in Langflow, the open-source visual LLM-workflow builder — unauthenticated code-execution flaws, IDORs, and CORS bugs that keep landing on CISA's Known Exploited Vulnerabilities catalog as public-facing deployments get hit.
CVEs
[ HIGH ] CVSS 8.4 EPSS 0.2% kev
Langflow /api/v1/responses IDOR — cross-user flow execution
An authenticated IDOR in Langflow's /api/v1/responses endpoint lets a logged-in attacker execute any other user's flow by passing the victim's flow UUID. NVD scores it 8.4 high; the vendor GHSA calls it 9.9 critical. Fixed in Langflow 1.9.1. Added to CISA KEV on 2026-07-07.
Langflow / Langflow (versions before 1.9.1)
[ CRITICAL ] CVSS 9.8 kev
Langflow validate-endpoint exec_globals RCE (unauthenticated)
Unauthenticated RCE in Langflow's /api/v1/validate endpoint via the exec_globals parameter. CISA added to KEV on 2026-07-21 with a federal patch deadline of 2026-07-24.
Langflow / Langflow
