Langflow Vulnerability CVE-2026

Langflow versions up to and including 1.6.9 chain two web-security weaknesses - a permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh-token cookie set with SameSite=None - into account takeover and remote code execution. When an authenticated Langflow user visits an attacker-controlled webpage, the browser silently sends credentialed cross-origin requests that successfully call the refresh endpoint, letting the attacker mint fresh access_token/refresh_token pairs for the victim's session (CWE-346). With those tokens, the attacker can access authenticated endpoints, including Langflow's built-in code-execution functionality, and run arbitrary code for full system compromise. Any Langflow deployment at or below version 1.6.9 is affected, with internet-facing instances most exposed. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-21, and EPSS assigns an 83.6% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Langflow to a release newer than 1.6.9 following vendor guidance, and invalidate existing sessions afterward. If patching must wait, correct the CORS configuration (do not combine allow_origins='*' with allow_credentials=True), stop marking the refresh-token cookie SameSite=None, and restrict internet exposure of the instance. Review access logs for refresh-endpoint calls from unexpected origins, rotate tokens and credentials for suspected victims, and follow BOD 22-01 requirements if you are a U.S. federal agency.

CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, an open-source visual builder for LLM and AI agent workflows. The flaw, categorized as CWE-829 (inclusion of functionality from an untrusted control sphere), resides in how the exec_globals parameter supplied to the validate endpoint is handled, allowing code or resources from an untrusted control sphere to be included and executed. A remote attacker with no credentials can send a crafted request to that endpoint and execute arbitrary code in the context of root on the affected installation. Any deployment of an affected Langflow version is exposed, with internet-facing self-hosted or containerized instances at greatest risk. The issue was disclosed through Trend Micro's Zero Day Initiative (ZDI-CAN-27325) and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, confirming active in-the-wild exploitation; no public proof-of-concept is known.

Do: Apply the vendor's patched Langflow release and any prescribed mitigations per CISA guidance; because exploitation requires no authentication and executes as root, prioritize internet-exposed instances immediately (EPSS is high at 63.4%). Per BOD 26-04, if mitigations or updates are unavailable for a given deployment, discontinue use of the product. Review access logs for unexpected unauthenticated requests to the validate endpoint containing crafted exec_globals parameters, and restrict network exposure of Langflow instances until patched.

Multiple critical API endpoints in Langflow, an open-source tool for building and deploying AI-powered agents and workflows, lack required authentication (CWE-306), so any unauthenticated user can reach them directly over the network with no privileges or user interaction required. By sending crafted requests to these endpoints, an attacker can read sensitive user conversation data and transaction histories and can perform destructive operations such as deleting messages. Any organization or individual running an affected Langflow deployment whose API is reachable, especially instances exposed to the internet, is affected, since the endpoints handle personal data and system operations that should require proper authorization. A public proof of concept is available via the project's GitHub security advisory (GHSA-c5cp-vx83-jhqx), EPSS assigns a 33.7% probability of exploitation within 30 days (98th percentile), and recent reporting indicates CISA has added actively exploited Langflow flaws to its KEV catalog, so this should be treated as exploited in the wild. Version 1.7.0.dev45 contains the patch.

Do: Upgrade Langflow to version 1.7.0.dev45 or later. If you cannot upgrade immediately, restrict access to the affected API endpoints to trusted networks or place them behind an authenticating reverse proxy or API gateway. Review logs for unauthenticated requests to conversation, transaction, and message endpoints, and check for unexpected message deletions or access to user conversation data.

CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files.

Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable.

CVE-2026-5027 is a path traversal flaw (CWE-22) in the 'POST /api/v2/files' endpoint of Langflow, the open-source platform for building AI/LLM agent workflows. The endpoint fails to sanitize the 'filename' field supplied in multipart form data, so an attacker who submits a name containing '../' sequences can direct the resulting file write to arbitrary locations on the server's filesystem. The CVSS vector (network-accessible, low complexity, low-privilege account required, no user interaction) indicates an authenticated user can abuse this to overwrite or create files at attacker-chosen paths, which can compromise confidentiality, integrity, and availability — for example by overwriting configuration, credentials, or executable content that leads to code execution depending on deployment. Any organization running a self-hosted Langflow instance that exposes the files API, even to low-privileged accounts, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific CVE, and it is not yet on CISA's KEV list, but its elevated EPSS (36.1%, 98th percentile) and active exploitation of other Langflow vulnerabilities (e.g., CVE-2026-0768) suggest near-term exploitation risk.

Do: Upgrade Langflow to the latest patched release per the vendor advisory (specific fixed version is not stated in the available data). Until patched, restrict access to /api/v2/files to trusted, authenticated users, place Langflow behind authentication/reverse-proxy filtering that strips or validates '..' sequences in multipart filenames, and avoid exposing the instance directly to the internet. Review access logs for multipart POST requests to /api/v2/files with filenames containing '../' that could indicate attempted traversal writes.