The Hacker Newspublished May 8, 13:52 UTC (May 8, 2025)ingested Sep 10, 05:53 UTC@TheHackersNews

Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence

criticalExploit / PoC exploited in the wildimportance 60CVE-2025-3248

Read the original

Tagscve-2025-3248 exploit

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-3248	Unauthenticated RCE in Langflow /api/v1/validate/code Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available. Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise.	9.8	100%	KEV ransomware PoC ×2	Langflow	moderatetens of thousands of self-hosted deployments, with likely only hundreds to low thousands directly exposed to the internet	Apr 7, 2025

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-3248

Unauthenticated RCE in Langflow /api/v1/validate/code

Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available.

Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise.

9.8

100%

KEV ransomware PoC ×2

Langflow

moderatetens of thousands of self-hosted deployments, with likely only hundreds to low thousands directly exposed to the internet

Apr 7, 2025

Full article382 words · extracted from thehackernews.com · click to collapse

Ravie LakshmananMay 06, 2025Cybersecurity / Vulnerability

A recently disclosed critical security flaw impacting the open-source Langflow platform has been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), citing evidence of active exploitation.

The vulnerability, tracked as CVE-2025-3248, carries a CVSS score of 9.8 out of a maximum of 10.0.

"Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests," CISA said.

Specifically, the endpoint has been found to improperly invoke Python's built-in exec() function on user-supplied code without adequate authentication or sandboxing, thereby allowing attackers to execute arbitrary commands on the server.

The shortcoming, which affects most versions of the popular tool, has been addressed in version 1.3.0 released on March 31, 2025. Horizon3.ai has been credited with discovering and reporting the flaw in February.

According to the company, the vulnerability is "easily exploitable" and allows unauthenticated remote attackers to take control of Langflow servers. A proof-of-concept (PoC) exploit has since been made publicly available as of April 9, 2025, by other researchers.

Data from attack surface management platform Censys shows that there are 466 internet-exposed Langflow instances, with a majority of them concentrated in the United States, Germany, Singapore, India, and China.

It's currently not known how the vulnerability is being abused in real-world attacks, by whom, and for what purpose, although the SANS Technology Institute said it recorded exploit attempts targeting the flaw against its honeypots. Federal Civilian Executive Branch (FCEB) agencies have time until May 26, 2025, to apply the fixes.

"CVE-2025-3248 highlights the risks of executing dynamic code without secure authentication and sandboxing measures," Zscaler noted last month. "This vulnerability serves as a critical reminder for organizations to approach code-validation features with caution, particularly in applications exposed to the internet."

Update

Attack surface management platform Censys said it has observed 1,156 exposed Langflow servers online, nearly half of which are located in the United States. Of these, 360 servers appear to be running a vulnerable version. As many as 509 servers did not advertise a version.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/critical-langflow-flaw-added-to-cisa.html