Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{servername}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOWAUTOLOGIN=true, GET /api/v1/autologin hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTOLOGIN is documented as a development-only setting; with it…
Recommended action: Upgrade to 0.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/{flowid}/vertices (retrieveverticesorder) - POST /api/v1/build/{flowid}/vertices/{vertexid} (buildvertex) Any authenticated user who knows (or obtains) another user's flowid could load that user's private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response. Both routes are declared with deprecated=True, includeinschema=False, so they do not appear in the OpenAPI docs, but they remained registered on the router. The Langflow UI no longer calls them (it uses POST /api/v1/build/{flowid}/flow), so they are only reachable by direct HTTP requests. The issue is fixed in Langflow 1.10.1 (langflow-base 0.10.1) by #13153. Details In affected versions, both handlers go straight to the graph loader: - retrieveverticesorder…
Recommended action: Upgrade to 0.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example http://169.254.169.254/latest/meta-data/), and in many cases read the response back through the component output. Two things combined to cause this: 1. Protection disabled / warn-only. The SSRF guard (lfx/utils/ssrfprotection.py, added in 1.7.0 by #10544) shipped with ssrfprotectionenabled = False, and its only caller, the API Request component, called validateurlforssrf(url, warnonly=True). So even with protection turned on, blocked URLs were only logged. 2. Inconsistent coverage. Other components that take a user-supplied URL or base URL did not call the guard at all: RSS Reader, SearXNG, Web Search (fetching result / RSS URLs), Home Assistant,…
Recommended action: Upgrade to 0.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function createuploadfile of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Recommended action: Upgrade to 0.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/{flowid} The readflow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTOLOGIN setting to decide whether to filter by userid. When AUTOLOGIN was False (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This exposed any authenticated user to: - Read any other user's flow, including embedded plaintext API keys - Modify the logic of another user's AI agents - Delete flows belonging to other users The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with userid = NULL) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. --- Fix (PR #8956) The fix removes the AUTOLOGIN conditional entirely and unconditionally scopes the query to the requesting user: All three operations — read, update, and delete —…
Recommended action: Upgrade to 0.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Details The vulnerability exists in three API endpoints within src/backend/base/langflow/api/v1/monitor.py that are missing the required dependencies=[Depends(getcurrentactiveuser)] authentication dependency: Affected Endpoints: 1. GET /api/v1/monitor/messages (Line 61) 2. GET /api/v1/monitor/transactions (Line 183) 3. DELETE /api/v1/monitor/messages/session/{sessionid} (Line 165) Inconsistency Evidence: Other endpoints in the same file properly implement authentication: PoC Complete reproduction steps to demonstrate the vulnerability: Prerequisites: 1. Start a Langflow server instance 2. Ensure no authentication headers or API…
Recommended action: Upgrade to 0.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This vulnerability was discovered by researchers at Check Point. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed. Summary A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. Details Langflow's Docker image includes a CLI binary at /app/.venv/bin/langflow that exposes sensitive commands, including: langflow superuser This command allows creation of a new superuser without checking whether one already exists. When combined with code execution (e.g., via the authenticated /api/v1/validate/code endpoint), a low-privileged user can execute: /app/.venv/bin/langflow superuser inside the container, and elevate themselves to full…
Recommended action: Upgrade to 0.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.