langflow

Langflow is a powerful tool for building and deploying AI-powered agents and workflows.

View on Pypi

View on Github

Activity

Latest release: 6h ago
Total releases: 451
Cadence: ~daily
Last 12 months: 184

Reach

Stars: 154.7k

Details

License: MIT
First release: Mar 14, 2023

Releases

Version	Released
`1.13.0.dev12` pre	Sep 14, 2026
`1.13.0.dev11` pre	Sep 13, 2026
`1.13.0.dev10` pre	Sep 12, 2026
`1.12.2rc1` pre	Sep 11, 2026
`1.13.0.dev9` pre	Sep 11, 2026
`1.12.2rc0` pre	Sep 11, 2026
`1.13.0.dev8` pre	Sep 10, 2026
`1.13.0.dev7` pre	Sep 09, 2026
`1.12.1` patch	Sep 08, 2026
`1.13.0.dev6` pre	Sep 08, 2026
`1.13.0.dev5` pre	Sep 07, 2026
`1.13.0.dev4` pre	Sep 06, 2026
`1.13.0.dev3` pre	Sep 05, 2026
`1.13.0.dev2` pre	Sep 04, 2026
`1.13.0.dev1` pre	Sep 03, 2026
`1.13.0.dev0` pre	Sep 02, 2026
`1.12.0` minor	Sep 01, 2026
`1.12.0rc4` pre	Sep 01, 2026
`1.12.0.dev45` pre	Sep 01, 2026
`1.11.6` patch	Sep 01, 2026
`1.12.0.dev44` pre	Aug 31, 2026
`1.12.0.dev43` pre	Aug 30, 2026
`1.12.0rc3` pre	Aug 29, 2026
`1.12.0.dev42` pre	Aug 29, 2026
`1.12.0.dev41` pre	Aug 28, 2026
`1.12.0.dev40` pre	Aug 27, 2026
`1.12.0.dev39` pre	Aug 26, 2026
`1.12.0rc2` pre	Aug 25, 2026
`1.11.5` patch	Aug 25, 2026
`1.12.0rc1` pre	Aug 25, 2026
`1.12.0rc0` pre	Aug 25, 2026
`1.12.0.dev38` pre	Aug 25, 2026
`1.12.0.dev37` pre	Aug 24, 2026
`1.12.0.dev36` pre	Aug 23, 2026
`1.12.0.dev35` pre	Aug 22, 2026
`1.12.0.dev34` pre	Aug 21, 2026
`1.12.0.dev33` pre	Aug 20, 2026
`1.12.0.dev32` pre	Aug 19, 2026
`1.11.4` patch	Aug 18, 2026
`1.12.0.dev31` pre	Aug 18, 2026
`1.11.4rc3` pre	Aug 17, 2026
`1.12.0.dev30` pre	Aug 17, 2026
`1.12.0.dev29` pre	Aug 16, 2026
`1.12.0.dev28` pre	Aug 15, 2026
`1.12.0.dev27` pre	Aug 15, 2026
`1.11.4rc2` pre	Aug 14, 2026
`1.12.0.dev26` pre	Aug 14, 2026
`1.12.0.dev25` pre	Aug 13, 2026
`1.12.0.dev24` pre	Aug 12, 2026
`1.11.3` patch	Aug 11, 2026

1–50 of 451

Repository

langflow-ai/langflow

Forks: 10.1k
Open issues: 234
Language: Python

react-flow
chatgpt
large-language-models
generative-ai
agents
multiagent

Dependencies (33)

Depends on

1.13.0.dev12

Used by

Supply-chain exposure

12 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (32)

CVE-2026-42867 PYSEC-2026-2566 GHSA-79ph-745m-6wxq Jul 13, 2026

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

6.5 / 10
Medium
Network Low None None Unchanged None Low Low

Summary

Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

Details

The vulnerability exists in the create_knowledge_base function within src/backend/base/langflow/api/v1/knowledge_bases.py.

This function constructs file paths directly from the user-supplied name field without sanitization. The value is concatenated with the user's base directory and passed directly to kb_path.mkdir(). Immediately following the directory creation, the application writes embedding_metadata.json and schema.json into this attacker-controlled path.

PoC (Proof of Concept)

For the Create endpoint, an attacker can supply traversal sequences or absolute paths in the name field:

../victim_user/evil_kb or /tmp/pwned

This forces kb_path.mkdir() to create directories and write specific application files (embedding_metadata.json and schema.json) at any reachable path on the server.

Impact

Any Langflow instance exposing this endpoint to authenticated users is vulnerable. This exposes the server to:

Cross-user data compromise: Creation of directories and files within another tenant's knowledge base space.

Arbitrary filesystem manipulation: Directory creation at any path on the server where the application has write permissions (e.g., /app/data).

Data overwrite: Overwriting existing embedding_metadata.json and schema.json files in attacker-targeted paths, potentially corrupting existing knowledge bases.

Fixes

The issue was addressed in PR #12337. The fix introduces the _validate_kb_path_containment() helper function, which uses Path.is_relative_to() instead of startswith() to enforce strict path boundaries and prevent prefix-ambiguity bugs. This helper is applied before any filesystem operations. Regression tests were added to verify that traversal payloads return a 403 Forbidden.

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability:

@ddlxstudio

@nekros1xx

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 281 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.31.8.01.8.0rc01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.0rc61.8.11.8.21.8.31.8.3rc01.8.4

Fixed in

1.9.0

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq
https://github.com/langflow-ai/langflow/pull/12337
https://github.com/langflow-ai/langflow
https://pypi.org/project/langflow
https://github.com/advisories/GHSA-79ph-745m-6wxq
https://nvd.nist.gov/vuln/detail/CVE-2026-42867

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-6599 PYSEC-2026-2569 GHSA-v66p-f7x3-4794 Jul 13, 2026

Langflow vulnerable to injection

Medium
Network Low Low None

A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get_client_ip/install_mcp_config of the file src/backend/base/langflow/api/v1/mcp_projects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument X-Forwarded-For results in injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 280 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.31.8.01.8.0rc01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.0rc61.8.11.8.21.8.31.8.3rc0

References

https://nvd.nist.gov/vuln/detail/CVE-2026-6599
https://gist.github.com/chenhouser2025/a909c47316b7a0948ee68c109ab747a3
https://github.com/langflow-ai/langflow
https://vuldb.com/submit/791922
https://vuldb.com/vuln/358234
https://vuldb.com/vuln/358234/cti

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-6598 PYSEC-2026-2568 GHSA-9jpj-cph8-w449 Jul 13, 2026

Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

Medium
Network Low Low None

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth_settings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 282 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.31.8.01.8.0rc01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.0rc61.8.11.8.21.8.31.8.3rc01.8.41.9.0

Fixed in

1.9.1

References

https://nvd.nist.gov/vuln/detail/CVE-2026-6598
https://github.com/langflow-ai/langflow/commit/45325f6376309a91f5017fa033a96c09c7e295e3
https://gist.github.com/chenhouser2025/77adb3486c06c635ae4b09a3eaf90213
https://github.com/langflow-ai/langflow
https://vuldb.com/submit/791921
https://vuldb.com/vuln/358233

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-6597 PYSEC-2026-2565 GHSA-5jjf-wcvf-923w Jul 13, 2026

Langflow has an Information Leak through Incomplete API Key Redaction

Medium
Network Low High None

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 280 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.31.8.01.8.0rc01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.0rc61.8.11.8.21.8.31.8.3rc0

References

https://nvd.nist.gov/vuln/detail/CVE-2026-6597
https://gist.github.com/chenhouser2025/b93261c6e651f14800a4f2e4365f357b
https://github.com/langflow-ai/langflow
https://vuldb.com/submit/791920
https://vuldb.com/vuln/358232
https://vuldb.com/vuln/358232/cti

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-34046 PYSEC-2026-2567 GHSA-8c4j-f57c-35cf PYSEC-2026-2570 Jul 13, 2026

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Critical
Network Low Low None

Vulnerability

IDOR in GET/PATCH/DELETE /api/v1/flow/{flow_id}

The _read_flow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTO_LOGIN setting to decide whether to filter by user_id. When AUTO_LOGIN was False (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it.

This exposed any authenticated user to:

Read any other user's flow, including embedded plaintext API keys

Modify the logic of another user's AI agents

Delete flows belonging to other users

The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with user_id = NULL) under auto-login mode, but inadvertently left the authenticated path without an ownership filter.

Fix (PR #8956)

The fix removes the AUTO_LOGIN conditional entirely and unconditionally scopes the query to the requesting user:

- auth_settings = settings_service.auth_settings - stmt = select(Flow).where(Flow.id == flow_id) - if auth_settings.AUTO_LOGIN: - stmt = stmt.where( - (Flow.user_id == user_id) | (Flow.user_id == None) # noqa: E711 - ) + stmt = select(Flow).where(Flow.id == flow_id).where(Flow.user_id == user_id)

All three operations — read, update, and delete — route through _read_flow, so the single change covers the full attack surface. A cross-user isolation test (test_read_flows_user_isolation) was added to prevent regression.

Acknowledgements

Langflow thanks the security researcher who responsibly disclosed this vulnerability:

@chximn-dt

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 253 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post2

Fixed in

1.5.1

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf
https://nvd.nist.gov/vuln/detail/CVE-2026-34046
https://github.com/langflow-ai/langflow/pull/8956
https://github.com/langflow-ai/langflow
https://pypi.org/project/langflow
https://github.com/advisories/GHSA-8c4j-f57c-35cf

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-0770 PYSEC-2026-1525 GHSA-g22f-v6f7-2hrh Jul 07, 2026

Langflow affected by Remote Code Execution via validate_code() exec()

Critical
Network Low None None

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 268 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.3

References

https://nvd.nist.gov/vuln/detail/CVE-2026-0770
https://github.com/affix/CVE-2026-0770-PoC
https://github.com/langflow-ai/langflow
https://www.zerodayinitiative.com/advisories/ZDI-26-036
https://pypi.org/project/langflow
https://github.com/advisories/GHSA-g22f-v6f7-2hrh

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-21445 PYSEC-2026-1524 GHSA-c5cp-vx83-jhqx PYSEC-2026-2571 Jul 07, 2026

Langflow Missing Authentication on Critical API Endpoints

Critical
Network Low None None

Summary

Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.

Details

The vulnerability exists in three API endpoints within src/backend/base/langflow/api/v1/monitor.py that are missing the required dependencies=[Depends(get_current_active_user)] authentication dependency:

Affected Endpoints:

GET /api/v1/monitor/messages (Line 61)

@router.get("/messages") # ❌ Missing authentication async def get_messages( session: DbSession, flow_id: Annotated[UUID | None, Query()] = None, session_id: Annotated[str | None, Query()] = None, # ... other parameters ) -> list[MessageResponse]:

GET /api/v1/monitor/transactions (Line 183)

@router.get("/transactions") # ❌ Missing authentication async def get_transactions( flow_id: Annotated[UUID, Query()], session: DbSession, params: Annotated[Params | None, Depends(custom_params)], ) -> Page[TransactionTable]:

DELETE /api/v1/monitor/messages/session/{session_id} (Line 165)

@router.delete("/messages/session/{session_id}", status_code=204) # ❌ Missing authentication async def delete_messages_session( session_id: str, session: DbSession, ):

Inconsistency Evidence: Other endpoints in the same file properly implement authentication:

@router.get("/messages/sessions", dependencies=[Depends(get_current_active_user)]) # ✅ Properly secured @router.delete("/messages", status_code=204, dependencies=[Depends(get_current_active_user)]) # ✅ Properly secured

PoC

Complete reproduction steps to demonstrate the vulnerability:

Prerequisites:

Start a Langflow server instance

Ensure no authentication headers or API keys are provided

Reproduction Commands:

# 1. Access all user conversations without authentication curl http://localhost:7860/api/v1/monitor/messages # 2. Access transaction history without authentication curl "http://localhost:7860/api/v1/monitor/transactions?flow_id=00000000-0000-0000-0000-000000000000" # 3. Delete user messages by session without authentication curl -X DELETE http://localhost:7860/api/v1/monitor/messages/session/00000000-0000-0000-0000-000000000000

Expected vs Actual Behavior:

Expected: All requests should return 401 Unauthorized

Actual: All requests return successful responses with sensitive data or perform destructive operations

Impact

Vulnerability Type: Broken Authentication and Authorization (OWASP Top 10 - A01:2021)

Severity: High

Who is Impacted:

All Langflow users: Personal conversation data exposed to unauthorized access

System administrators: Transaction logs disclosed

Specific Impacts:

Data Breach: Unauthorized access to user conversations containing potentially sensitive personal information

Privacy Violation: Transaction histories and user activity patterns exposed without consent

Data Destruction: Malicious actors can delete user conversation histories without authorization

Compliance Risk: Potential violations of data protection regulations (GDPR, CCPA, etc.)

System Intelligence: Attackers can gather information about system usage patterns and user behavior

Attack Scenarios:

Malicious users accessing proprietary conversation data

Malicious users deleting other users' conversation histories

Automated scraping of all user conversations for data harvesting

Reconnaissance attacks to understand system architecture and usage patterns

Recommended Fix: Add authentication dependencies to all affected endpoints:

@router.get("/messages", dependencies=[Depends(get_current_active_user)]) @router.get("/transactions", dependencies=[Depends(get_current_active_user)]) @router.delete("/messages/session/{session_id}", dependencies=[Depends(get_current_active_user)])

Environment:

Langflow Version: Current main branch

Affected Components: API v1 monitoring endpoints

Authentication System: FastAPI dependency injection with get_current_active_user

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 265 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.0

Fixed in

1.7.1

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx
https://nvd.nist.gov/vuln/detail/CVE-2026-21445
https://github.com/langflow-ai/langflow/commit/3fed9fe1b5658f2c8656dbd73508e113a96e486a
https://github.com/langflow-ai/langflow
https://github.com/langflow-ai/langflow/releases/tag/1.7.1
https://pypi.org/project/langflow

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-68477 PYSEC-2026-1522 GHSA-5993-7p27-66g5 Jul 07, 2026

Langflow vulnerable to Server-Side Request Forgery

7.7 / 10
High
Network Low Low None Changed High None None

Vulnerability Overview

Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127.0.0.1, the 10/172/192 ranges) or cloud metadata endpoints (169.254.169.254), and it returns the response body as the result.

Because the flow execution endpoints (/api/v1/run, /api/v1/run/advanced) can be invoked with just an API key, if an attacker can control the API Request URL in a flow, non-blind SSRF is possible—accessing internal resources from the server’s network context. This enables requests to, and collection of responses from, internal administrative endpoints, metadata services, and internal databases/services, leading to information disclosure and providing a foothold for further attacks.

Vulnerable Code

When a flow runs, the API Request URL is set via user input or tweaks, or it falls back to the value stored in the node UI.

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L349-L359

@router.post("/run/{flow_id_or_name}", response_model=None, response_model_exclude_none=True) async def simplified_run_flow( *, background_tasks: BackgroundTasks, flow: Annotated[FlowRead | None, Depends(get_flow_by_id_or_endpoint_name)], input_request: SimplifiedAPIRequest | None = None, stream: bool = False, api_key_user: Annotated[UserRead, Depends(api_key_security)], context: dict | None = None, http_request: Request, ):

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L573-L588

@router.post( "/run/advanced/{flow_id_or_name}", response_model=RunResponse, response_model_exclude_none=True, ) async def experimental_run_flow( *, session: DbSession, flow: Annotated[Flow, Depends(get_flow_by_id_or_endpoint_name)], inputs: list[InputValueRequest] | None = None, outputs: list[str] | None = None, tweaks: Annotated[Tweaks | None, Body(embed=True)] = None, stream: Annotated[bool, Body(embed=True)] = False, session_id: Annotated[None | str, Body(embed=True)] = None, api_key_user: Annotated[UserRead, Depends(api_key_security)], ) -> RunResponse:

Normalization/validation stage: It only checks that the URL is non-empty and well-formed. No blocking of private networks, localhost, or IMDS.

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L280-L289

def _normalize_url(self, url: str) -> str: """Normalize URL by adding https:// if no protocol is specified.""" if not url or not isinstance(url, str): msg = "URL cannot be empty" raise ValueError(msg) url = url.strip() if url.startswith(("http://", "https://")): return url return f"https://{url}"

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L433-L438

url = self._normalize_url(url) # Validate URL if not validators.url(url): msg = f"Invalid URL provided: {url}" raise ValueError(msg)

On the server side, it sends a request to an arbitrary URL using httpx.AsyncClient and exposes the response body as metadata["result"].

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L312-L322

try: # Prepare request parameters request_params = { "method": method, "url": url, "headers": headers, "json": processed_body, "timeout": timeout, "follow_redirects": follow_redirects, } response = await client.request(**request_params)

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L335-L340

# Base metadata metadata = { "source": url, "status_code": response.status_code, "response_headers": response_headers, }

https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L364-L379

# Handle response content if is_binary: result = response.content else: try: result = response.json() except json.JSONDecodeError: self.log("Failed to decode JSON response") result = response.text.encode("utf-8") metadata["result"] = result if include_httpx_metadata: metadata.update({"headers": headers}) return Data(data=metadata)

PoC

PoC Description

I launched a Langflow server using the latest langflowai/langflow:latest Docker container, and a separate container internal-api that exposes an internal-only endpoint /internal on port 8000. Both containers were attached to the same user-defined network (ssrf-net), allowing communication by name or via the IP 172.18.0.3.

I added an API Request node to a Langflow flow and set the URL to the internal service (http://172.18.0.3:8000/internal). Then I invoked /api/v1/run/advanced/<FLOW_ID> with an API key to perform SSRF. The response returned the internal service’s body in the result field, confirming non-blind SSRF.

PoC

Langflow Setting

Exploit

curl -s -X POST 'http://localhost:7860/api/v1/run/advanced/0b7f7713-d88c-4f92-bcf8-0dafe250ea9d' \ -H 'Content-Type: application/json' \ -H 'x-api-key: sk-HHc93OjH_4ep_EhfWrweP1IwpooJ3ZZnYOu-HgqJV4M' \ --data-raw '{ "inputs":[{"components":[],"input_value":""}], "outputs":["Chat Output"], "tweaks":{"API Request":{"url_input":"http://172.18.0.3:8000/internal","include_httpx_metadata":false}}, "stream":false }' | jq -r '.outputs[0].outputs[0].results.message.text | sub("^```json\\n";"") | sub("\\n```$";"") | fromjson | .result'

Impact

Scanning internal assets and data exfiltration: Attackers can access internal administrative HTTP endpoints, proxies, metrics dashboards, and management consoles to obtain sensitive information (versions, tokens, configurations).

Access to metadata services: In cloud environments, attackers can use 169.254.169.254, etc., to steal instance metadata and credentials.

Foothold for attacking internal services: Can forge requests by abusing inter-service trust and become the starting point of an SSRF→RCE chain (e.g., invoking an internal admin API).

Non-blind: Because the response body is returned to the client, attackers can immediately view and exploit the collected data.

Risk in multi-tenant environments: Bypassing tenant boundaries can cause cross-leakage of internal network information, resulting in high impact. Even in single-tenant setups, the risk remains high depending on internal network policies.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 265 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.19.post11.0.19.post21.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.4.post11.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.31.5.01.5.0.post11.5.0.post21.5.11.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.0

Fixed in

1.7.1

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-5993-7p27-66g5
https://nvd.nist.gov/vuln/detail/CVE-2025-68477
https://github.com/langflow-ai/langflow
https://pypi.org/project/langflow
https://github.com/advisories/GHSA-5993-7p27-66g5

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-48061 PYSEC-2026-1523 GHSA-5p5r-57fx-pmfr Jul 07, 2026

Langflow vulnerable to remote code execution

Low
Network Low None None

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 231 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.9

References

https://nvd.nist.gov/vuln/detail/CVE-2024-48061
https://github.com/langflow-ai/langflow/issues/696
https://gist.github.com/AfterSnows/1e58257867002462923fd62dde2b5d61
https://github.com/langflow-ai/langflow
https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8
https://pypi.org/project/langflow

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9277 PYSEC-2026-1521 GHSA-355v-2rjx-fpx7 Jul 07, 2026

Inefficient Regular Expression Complexity in langflow

Medium
Adjacent Low Low None

A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected versions

0.0.310.0.320.0.330.0.400.0.440.0.450.0.460.0.520.0.530.0.540.0.550.0.56

+ 231 more Show less

0.0.570.0.580.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.780.0.790.0.800.0.810.0.830.0.840.0.850.0.860.0.870.0.880.0.890.1.00.1.20.1.30.1.40.1.50.1.60.1.70.2.00.2.10.2.100.2.110.2.120.2.130.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.100.4.110.4.120.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0a00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0b00.5.0b20.5.0b30.5.0b40.5.0b50.5.0b60.5.10.5.100.5.110.5.120.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.90.6.00.6.0rc10.6.10.6.100.6.110.6.120.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.30.6.3a00.6.3a10.6.3a20.6.3a30.6.3a40.6.3a50.6.3a60.6.3a70.6.40.6.4a00.6.4a10.6.50.6.5a00.6.5a10.6.5a100.6.5a110.6.5a120.6.5a130.6.5a20.6.5a30.6.5a40.6.5a50.6.5a60.6.5a70.6.5a80.6.5a90.6.60.6.70.6.7a10.6.7a20.6.7a30.6.7a50.6.80.6.91.0.01.0.0a01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a131.0.0a141.0.0a151.0.0a171.0.0a181.0.0a191.0.0a21.0.0a201.0.0a211.0.0a221.0.0a231.0.0a241.0.0a251.0.0a261.0.0a271.0.0a281.0.0a291.0.0a31.0.0a301.0.0a311.0.0a321.0.0a331.0.0a341.0.0a351.0.0a361.0.0a371.0.0a381.0.0a391.0.0a41.0.0a401.0.0a411.0.0a421.0.0a431.0.0a441.0.0a451.0.0a461.0.0a471.0.0a481.0.0a491.0.0a51.0.0a501.0.0a511.0.0a521.0.0a531.0.0a551.0.0a561.0.0a571.0.0a581.0.0a591.0.0a61.0.0a601.0.0a611.0.0a71.0.0a81.0.0a91.0.0rc01.0.0rc11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.9

References

https://nvd.nist.gov/vuln/detail/CVE-2024-9277
https://github.com/langflow-ai/langflow
https://github.com/langflow-ai/langflow/blob/main/src/backend/base/langflow/interface/utils.py#L65
https://rumbling-slice-eb0.notion.site/Remote-Redos-in-https-github-com-langflow-ai-langflow-067159ced0d5494e91b06071384969c4?pvs=4
https://vuldb.com/?ctiid.278659
https://vuldb.com/?id.278659

Updated Jul 07, 2026 · Source: OSV.dev

1–10 of 32

Insights

Releases per month

last 12 months

Release mix

major 1
minor 18
patch 176
pre 255

451 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More