Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Langflow — Vulnerabilities & Security Advisories 49

All 49 CVE vulnerabilities found in Langflow, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability records associated with the open-source product Langflow, developed by DataStax. The collection primarily documents security flaws reported against the Langflow platform, covering its recent release history. Users can track the vendor’s advisory history, analyze recurring weakness classes such as injection and access control issues, and review the chronological development of vulnerabilities disclosed for this specific product.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write CWE-290 7.1 High 2026-10-05
CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server CWE-78 9.9 Critical 2026-10-05
CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers CWE-639 7.1 High 2026-10-05
CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints CWE-639 5.4 Medium 2026-10-05
CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration CWE-78 9.9 Critical 2026-10-05
CVE-2026-101861 Langflow Code Execution via eval() in Component Input Schema CWE-95 4.1 Medium 2026-09-28
CVE-2026-48520 Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read CWE-73 6.1 Medium 2026-06-23
CVE-2026-33760 Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints CWE-639 8.8 High 2026-06-23
CVE-2026-42867 Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint CWE-22 6.5 Medium 2026-06-23
CVE-2026-55255 Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow CWE-639 8.4 High 2026-06-23
CVE-2026-55423 Langflow: Logout button does not clear session CWE-613 6.1 Medium 2026-06-23
CVE-2026-55446 Langflow: Unauthenticated DoS through multipart form boundary file upload CWE-400 7.5 High 2026-06-23
CVE-2026-48519 Langflow: Unauthenticated RCE in Shareable Playgrounds CWE-94 9.6 Critical 2026-06-23
CVE-2026-55447 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit CWE-61 9.6 Critical 2026-06-23
CVE-2026-55450 Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak CWE-200 9.3 Critical 2026-06-23
CVE-2026-12822 langflow-ai langflow Bundle URL Loader code injection CWE-94 5.3 Medium 2026-06-21
CVE-2026-42048 Langflow: Path Traversal in Langflow Knowledge Bases API CWE-22 9.6 Critical 2026-05-12
CVE-2026-7700 langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection CWE-94 6.3 Medium 2026-05-03
CVE-2026-7687 langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection CWE-77 6.3 Medium 2026-05-03
CVE-2026-6600 langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting CWE-79 3.5 Low 2026-04-20
CVE-2026-6599 langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection CWE-74 6.3 Medium 2026-04-20
CVE-2026-6598 langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file CWE-313 4.3 Medium 2026-04-20
CVE-2026-6597 langflow-ai langflow Flow Using API core.py has_api_terms credentials storage CWE-256 2.7 Low 2026-04-20
CVE-2026-6596 langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload CWE-434 7.3 High 2026-04-20
CVE-2026-34046 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check CWE-639 8.2 - 2026-03-27
CVE-2026-33873 Langflow has Authenticated Code Execution in Agentic Assistant Validation CWE-94 8.8 - 2026-03-27
CVE-2026-5027 Langflow - Path Traversal Arbitrary File Write via upload_user_file CWE-22 8.8 High 2026-03-27
CVE-2026-5026 Langflow - Stored XSS via Malicious SVG Upload CWE-79 5.4 - 2026-03-27
CVE-2026-5025 Langflow - Application Logs Exposed to All Authenticated Users CWE-862 6.5 Medium 2026-03-27
CVE-2026-5022 Langflow - Missing Authorization on download_image Endpoint CWE-862 5.3 - 2026-03-27

All 49 known CVE vulnerabilities affecting Langflow with full Chinese analysis, references, and POCs where available.