Langflow
Vulnerabilities in Langflow, the open-source visual LLM-workflow builder — unauthenticated code-execution flaws, IDORs, and CORS bugs that keep landing on CISA's Known Exploited Vulnerabilities catalog as public-facing deployments get hit.
Langflow /api/v1/responses IDOR — cross-user flow execution
An authenticated IDOR in Langflow's /api/v1/responses endpoint lets a logged-in attacker execute any other user's flow by passing the victim's flow UUID. NVD scores it 8.4 high; the vendor GHSA calls it 9.9 critical. Fixed in Langflow 1.9.1. Added to CISA KEV on 2026-07-07.
Langflow public flow build endpoint allows unauthenticated RCE
Langflow < 1.9.0: public flow build endpoint accepts attacker-supplied Python code passed to exec() with no sandboxing — unauthenticated RCE. CVSS 9.8 critical.
Langflow validate-endpoint exec_globals RCE (unauthenticated)
Unauthenticated RCE in Langflow's /api/v1/validate endpoint via the exec_globals parameter. CISA added to KEV on 2026-07-21 with a federal patch deadline of 2026-07-24.
Langflow CORS misconfiguration enables CSRF-driven token theft and RCE
Langflow ≤ 1.6.9: permissive CORS and SameSite=None cookies enable CSRF token theft, giving attackers RCE via authenticated endpoints. CVSS 8.8 high. CISA KEV 2026-05-21.
Langflow unauthenticated code injection in validate/code endpoint
Langflow < 1.3.0: unauthenticated code injection allows RCE via crafted HTTP requests to /api/v1/validate/code. CVSS 9.8 critical. CISA KEV 2025-05-05.
Public PoC Lands for Langflow's 9.8 Unauth RCE — Patch to 1.10.1 Now
CVE-2026-9198 lets an unauthenticated network caller reach full remote code execution on default Langflow deployments. It's on CISA's KEV list, it's exploited, and a public proof-of-concept is now out.
Langflow's fifth KEV entry: CVE-2026-0770, patch by Friday
CISA added Langflow's unauthenticated RCE flaw CVE-2026-0770 to KEV on 2026-07-21 with a federal deadline of 2026-07-24. Fifth Langflow entry on the catalog in fourteen months — upgrade past 1.7.3.