Langflow-ai Langflow
36 CVEs affecting Langflow-ai Langflow. Latest disclosed: 2026-06-23. Critical: 11, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33873 | Critical | 9.9 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-g… |
CVE-2026-33309 | Critical | 9.9 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exte… |
CVE-2026-33017 | Critical | 9.8 | 2026-03-20 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow end… |
CVE-2026-27966 | Critical | 9.8 | 2026-02-26 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerou… |
CVE-2025-3248 | Critical | 9.8 | 2025-04-07 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send craft… |
CVE-2026-55447 | Critical | 9.6 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attack… |
CVE-2026-48519 | Critical | 9.6 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains… |
CVE-2026-42048 | Critical | 9.6 | 2026-05-12 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases… |
CVE-2026-55450 | Critical | 9.3 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the serve… |
CVE-2026-33475 | Critical | 9.1 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHu… |
CVE-2026-21445 | Critical | 9.1 | 2026-01-02 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are mi… |
CVE-2026-33760 | High | 8.8 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perfo… |
CVE-2026-34046 | High | 8.8 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/ap… |
CVE-2026-5027 | High | 8.8 | 2026-03-27 | The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary loc… |
CVE-2026-33053 | High | 8.8 | 2026-03-20 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_k… |
CVE-2025-57760 | High | 8.8 | 2025-08-25 | Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an auth… |
CVE-2026-55255 | High | 8.4 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api… |
CVE-2025-68477 | High | 7.7 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issu… |
CVE-2026-55446 | High | 7.5 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without an… |
CVE-2026-33497 | High | 7.5 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile… |