[ Vendor · 5 CVEs ]
Langflow
CVEs affecting Langflow published in the last 30 days, plus any Langflow CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-55255 | 23 Jun 2026 | CVSS 8.4 | Langflow Authorization Bypass Through User-Controlled KeyLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR)… | ExploitedFix |
| CVE-2026-33017 | 20 Mar 2026 | CVSS 9.8 | Langflow Code InjectionLangflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST… | ExploitedFix |
| CVE-2026-0770 | 23 Jan 2026 | CVSS 9.8 | Langflow Inclusion of Functionality from Untrusted Control SphereLangflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote… | Exploited |
| CVE-2025-34291 | 5 Dec 2025 | CVSS 8.8 | Langflow Origin Validation ErrorLangflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly… | Exploited |
| CVE-2025-3248 | 7 Apr 2025 | CVSS 9.8 | Langflow Missing AuthenticationLangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can… | ExploitedFix |