Langflow vulnerabilities
Vulnerabilities in Langflow, the open-source visual LLM-workflow builder — unauthenticated code-execution flaws, IDORs, and CORS bugs that keep landing on CISA's Known Exploited Vulnerabilities catalog as public-facing deployments get hit.
We track 11 Langflow CVEs, 5 of them on CISA's Known Exploited Vulnerabilities catalog (1 flagged for ransomware use). The latest KEV addition is CVE-2026-0770, added .
- CVEs tracked
- 11
- On CISA KEV
- 5
- Ransomware use
- 1
- Rated critical
- 9
Most-exploited Langflow products
Latest Langflow coverage
Our reporting filed under Langflow, plus any story that cites one of its CVEs.
Langflow Critical Flaws Need an Upgrade to 1.13.0
IBM reports two critical unauthenticated Langflow flaws, CVE-2026-93680 and CVE-2026-110186. Every release through 1.12.8 is affected; 1.13.0 is the only fix.
vLLM Patches Unauth Memory DoS in 0.25.0
CVE-2026-116177 lets unauthenticated attackers exhaust vLLM inference server memory via Nemotron-VL. Affects 0.10.2 through 0.24.x; patch to 0.25.0.
Metasploit Ships Six Exploit Modules for Langflow
Rapid7's new Metasploit release adds six modules targeting Langflow, five covering critical RCEs. The worst, CVE-2026-10134, scores a perfect 10.0.
Plex2Shell Exploited to Deploy Miners, Linux Backdoor
Attackers exploited a five-CVE chain in Plex Media Server within 24 hours of a public PoC, loading unpatched servers with XMRig miners and a Linux proxy backdoor.
Langflow RCE Draws 1,423 Attacks: Patch to 1.9.0
CVE-2026-105740, CVSS 9.9, lets authenticated Langflow users execute server commands. Patch to 1.9.0 now; 1,423 exploit attempts logged since September 19.
Critical LMCache Flaw Exposes LLM Servers to Unauth RCE
CVE-2026-105192, a CVSS 9.8 flaw in LMCache's multiprocess server, lets unauthenticated attackers run code on LLM inference infrastructure. No patch exists.
- Langflow Patches CVSS 9.9 RCE in MCP Tool Handler
- Orkes Conductor RCE CVE-2026-58138 Exploited in Attacks
- Metasploit Drops 16 Modules, Five on CISA KEV
- JetBrains Cadence Breached via Unpatched TeamCity RCE
- PaperCut Attackers Steal Credentials From Schools
- IDScan Sued Over Breach of 153M Driver Licenses
- CISA Adds Seven Exploited Flaws to KEV Catalog
- Elasticsearch Patches RCE in Machine Learning Module
- Attackers Exploit Langflow to Steal OpenAI, AWS Keys
- Public PoC Lands for Langflow's 9.8 Unauth RCE — Patch to 1.10.1 Now
- N-Day Is Now N-Hour: The Vanishing Patch Window
- Langflow's fifth KEV entry: CVE-2026-0770, patch by Friday
- Sysdig: JADEPUFFER now ships EncForge, targets model weights
- NadMesh botnet raids exposed AI tools for 3,811 AWS keys
- CISA Adds Langflow and Two Joomla Builders to KEV
Known exploited Langflow vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-0770 Langflow validate-endpoint exec_globals RCE (unauthenticated)write-up | [ CRITICAL ] | 9.8 | 62.6% | ||
| CVE-2026-55255 Langflow /api/v1/responses IDOR — cross-user flow executionwrite-up | [ HIGH ] | 8.4 | 0.9% | ||
| CVE-2025-34291 Langflow CORS misconfiguration enables CSRF-driven token theft and RCEwrite-up | [ HIGH ] | 8.8 | 93.2% | ||
| CVE-2026-33017 Langflow public flow build endpoint allows unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | 96.4% | ||
| CVE-2025-3248 Langflow unauthenticated code injection in validate/code endpointransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
Every Langflow CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Other Langflow CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93674 Langflow Authenticated Blind Command Injectionwrite-up | [ CRITICAL ] | 9.8 | 15.3% | — |
| CVE-2026-7873 Langflow Authenticated RCE via Code Validation Endpointwrite-up | [ CRITICAL ] | 9.9 | 6.9% | — |
| CVE-2026-10134 Langflow Unauthenticated RCE in Public Flow Build Endpointwrite-up | [ CRITICAL ] | 10.0 | 2.3% | — |
| CVE-2026-0769 Langflow Unauthenticated RCE via Custom Component Evaluationwrite-up | [ CRITICAL ] | 9.8 | 41.2% | — |
| CVE-2026-105740 Authenticated RCE via MCP tool additionwrite-up | [ CRITICAL ] | 9.9 | 3.9% | — |
| CVE-2026-0768 Langflow Unauthenticated RCE via Code Execution Endpointwrite-up | [ CRITICAL ] | 9.8 | 28.1% | — |
Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.
Machine-readable: /api/v1/vendors/langflow.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.