langflow has 57 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 35 in the last 90 days against 13 in the 90 before. The busiest recent month was September 2026 with 35. The median CVSS is 8.1 (high), with 9 rated critical. 7% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 98 days (4 cases). The dominant weakness classes are CWE-22 (11) and CWE-918 (7).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 7% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- 98 d median(4)
- Last 90 days
- 35 prev 13
Worst active — by depth score
CVE-2025-3248Critical· 9.8Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint100CVE-2025-34291High· 8.8Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution92CVE-2026-55255Critical· 9.9Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow80CVE-2026-0770HighLangflow affected by Remote Code Execution via validate_code() exec()79CVE-2024-48061Critical· 9.8Langflow vulnerable to remote code execution66
langflow vulnerabilities
CVEs affecting langflow, newest first. Open any entry for full detail, references, and exploit status.
57 CVEsRSS
CVE-2026-19302Medium· 6.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
CVE-2026-19301Medium· 5.0IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-19300High· 7.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
CVE-2026-19299Medium· 6.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CVE-2026-19298High· 8.8IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
CVE-2026-55255Critical· 9.9CISA KEVPoCLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
CVE-2026-55423Medium· 6.1Langflow: Logout button does not clear session
Langflow: Logout button does not clear session
CVE-2026-55446High· 7.5Langflow: Unauthenticated DoS through multipart form boundary file upload
Langflow: Unauthenticated DoS through multipart form boundary file upload
CVE-2026-55447Critical· 9.6Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CVE-2026-55450Critical· 9.3PoCLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
CVE-2026-33760High· 8.8Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
CVE-2026-42867Medium· 6.5Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
CVE-2026-48519Critical· 9.6PoCLangflow: Unauthenticated RCE in Shareable Playgrounds
Langflow: Unauthenticated RCE in Shareable Playgrounds
CVE-2026-48520Medium· 6.1Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
CVE-2026-6599Medium· 6.3Langflow vulnerable to injection
Langflow vulnerable to injection
CVE-2026-6598Medium· 4.3Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
CVE-2026-6597Low· 2.7Langflow has an Information Leak through Incomplete API Key Redaction
Langflow has an Information Leak through Incomplete API Key Redaction
CVE-2026-3357High· 8.8IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
CVE-2026-5027High· 8.8PoCThe 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
CVE-2026-34046HighLangflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
CVE-2026-0770HighCISA KEV0dayPoCLangflow affected by Remote Code Execution via validate_code() exec()
Langflow affected by Remote Code Execution via validate_code() exec()
CVE-2025-68477High· 7.7Langflow vulnerable to Server-Side Request Forgery
Langflow vulnerable to Server-Side Request Forgery
CVE-2025-34291High· 8.8CISA KEVPoCLangflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a …
CVE-2025-57760High· 8.8Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
CVE-2025-3248Critical· 9.8CISA KEVPoCLangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
CVE-2024-48061Critical· 9.8PoCLangflow vulnerable to remote code execution
Langflow vulnerable to remote code execution
CVE-2024-9277Low· 3.5Inefficient Regular Expression Complexity in langflow
Inefficient Regular Expression Complexity in langflow