Langflow-ai vulnerabilities
42 CVEs and advisories name Langflow-ai as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-33497Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
- CVE-2026-33484Langflow has Unauthenticated IDOR on Image Downloads
- CVE-2026-33475Langflow GitHub Actions Shell Injection
- CVE-2026-33309Langflow has an Arbitrary File Write (RCE) via v2 API
- CVE-2026-33053Langflow has Missing Ownership Verification in API Key Deletion (IDOR)
- CVE-2026-33017Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
- CVE-2026-27966Langflow has Remote Code Execution in CSV Agent
- CVE-2026-21445Langflow Missing Authentication on Critical API Endpoints
- CVE-2025-68478Langflow Vulnerable to External Control of File Name or Path
- CVE-2025-68477Langflow vulnerable to Server-Side Request Forgery
- CVE-2025-57760Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation
- CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code