p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de langflow

Vulnerabilidades publicadas para langflow en los últimos 30 días: 6. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 43

  1. GHSA-j8f7-x8jm-wmm4

    Sin evaluarCorrección disponible

    Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

    ### Summary Before **Langflow 1.10.3**, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example `http://169.254.169.254/latest/meta-data/`), and in many cases read the response back through the component output. Two things combined to cause this: 1. **Protection disabled / warn-only.** The SSRF guard (`lfx/utils/ssrf_protection.py`, added in 1.7.0 by #10544) shipped with `ssrf_protection_enabl

    langflowPython
    • Actualiza a 1.10.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-105741

    Alta · CVSS 7.1EPSS 0,21%Corrección disponible

    Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

    langflowPython
    • Actualiza a 1.10.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-105699

    Alta · CVSS 7.1EPSS 0,25%Corrección disponible

    Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to handle_read_resource, which parsed a flow_id and filename and called storage_service.get_file without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handle_list_resources and han

    langflowPython
    • Actualiza a 1.9.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-105698

    Media · CVSS 5.4EPSS 0,18%Código de explotación públicoCorrección disponible

    Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and rec

    langflowPython
    • Actualiza a 1.10.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-105697

    Crítica · CVSS 9.9EPSS 0,47%Código de explotación públicoCorrección disponible

    Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

    Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Lang

    langflowPython
    • Actualiza a 1.10.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-51886

    Crítica · CVSS 9.8EPSS 0,4%Código de explotación públicoCorrección disponible

    CVE-2026-51886

    langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-t

    langflowPython
    • Actualiza a 1.10.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-9205

    Alta · CVSS 7.4EPSS 0,3%Código de explotación públicoCorrección disponible

    Langflow is affected by weaknesses in secret handling and sensitive configuration access

    IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

    langflowPython
    • Actualiza a 1.10.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2026-8505

    Crítica · CVSS 9.8EPSS 0,72%Código de explotación públicoCorrección disponible

    Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

    IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE).

    langflowPython
    • Actualiza a 1.9.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2026-7873

    Crítica · CVSS 9.9EPSS 1,07%Código de explotación públicoCorrección disponible

    Code Injection Vulnerability in Code Validation Endpoint

    IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

    langflowPython
    • Actualiza a 1.10.1.rc0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2026-48520

    Media · CVSS 6.1EPSS 0,44%Corrección disponible

    Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.

    langflowPython
    • Actualiza a 1.10.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2026-33760

    Alta · CVSS 8.8EPSS 0,5%Corrección disponible

    Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an

    langflowPython
    • Actualiza a 1.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2026-42867

    Media · CVSS 6.5EPSS 0,47%Corrección disponible

    Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0.

    langflowPython
    • Actualiza a 1.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2026-55255

    Alta · CVSS 8.4EPSS 0,89%En el catálogo KEVCorrección disponible

    Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

    langflow langflowPython
    • Actualiza a 1.9.1
    • Actualiza a 1.9.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-55423

    Media · CVSS 6.1EPSS 0,22%Corrección disponible

    Langflow: Logout button does not clear session

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

    langflowPython
    • Actualiza a 1.7.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-55446

    Alta · CVSS 7.5EPSS 0,58%Corrección disponible

    Langflow: Unauthenticated DoS through multipart form boundary file upload

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

    langflowPython
    • Actualiza a 1.0.19
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-48519

    Crítica · CVSS 9.6EPSS 0,78%Código de explotación públicoCorrección disponible

    Langflow: Unauthenticated RCE in Shareable Playgrounds

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed

    langflowPython
    • Actualiza a 1.9.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2026-55447

    Crítica · CVSS 9.6EPSS 0,66%Corrección disponible

    Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

    langflowPython
    • Actualiza a 1.9.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-55450

    Crítica · CVSS 9.3EPSS 1,19%Código de explotación públicoCorrección disponible

    Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.

    langflowPython
    • Actualiza a 1.9.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-10561

    Crítica · CVSS 10EPSS 0,82%Código de explotación públicoCorrección disponible

    Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection

    IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

    langflowPython
    • Actualiza a 1.10.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  20. CVE-2026-42048

    Crítica · CVSS 9.6EPSS 0,6%Corrección disponible

    Langflow: Path Traversal in Langflow Knowledge Bases API

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit this flaw to delete arbitrary directories anywhere on the server's filesystem, leading to data loss and potential service disruption. This vulnerability is fixed in 1.9.0.

    langflowPython
    • Actualiza a 1.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →