Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
36 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The /api/v1/files/images/{flowid}/{filename} endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flowid and filename returns the image with HTTP 200. Details src/backend/base/langflow/api/v1/files.py:138-164 — downloadimage takes flowid: UUID as a bare path parameter with no Depends(getflow) or CurrentActiveUser. All other file routes (downloadfile, uploadfile, listfiles, deletefile) use Depends(getflow) which enforces both authentication and ownership. There is no global auth middleware on /api/v1; protection is per-endpoint only. PoC Impact Unauthenticated cross-tenant data leak. In a multi-tenant deployment, any attacker who can discover or guess a flowid (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials.
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
While reviewing the recent patch for CVE-2025-68478 (External Control of File Name in v1.7.1), I discovered that the root architectural issue within LocalStorageService remains unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer ValidatedFileName dependency. This defense-in-depth failure leaves the POST /api/v2/files/ endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Details The vulnerability exists in two layers: 1. API Layer (src/backend/base/langflow/api/v2/files.py:162): Inside the uploaduserfile route, the filename is extracted directly from the multipart Content-Disposition header (newfilename = file.filename). It is passed verbatim to the storage service. ValidatedFileName provides zero protection here as it only guards…
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | src/backend/base/langflow/api/v1/apikey.py:44-53 | | Practical Exploitability | High | | Developer Approver | faizan@kolega.ai | Description The deleteapikeyroute() endpoint accepts an apikeyid path parameter and deletes it with only a generic authentication check (getcurrentactiveuser dependency). However, the deleteapikey() CRUD function does NOT verify that the API key belongs to the current user before deletion. Affected Code Evidence In crud.py lines 44-49, deleteapikey() retrieves the API key by ID and deletes it without checking if the key belongs to the authenticated user. The endpoint also doesn't pass the currentuser to the delete function for verification. Impact An authenticated attacker can enumerate and delete API keys belonging to other users by guessing or discovering their API key IDs. This allows account takeover, denial of service, and disruption of other users' integrations.…
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The POST /api/v1/buildpublictmp/{flowid}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The buildpublictmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. Affected Code Vulnerable Endpoint (No Authentication) File: src/backend/base/langflow/api/v1/chat.py, lines 580-657 Compare with the authenticated build endpoint at line 138, which requires currentuser: CurrentActiveUser. Code Execution Chain When attacker-supplied data is provided, it flows…
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Details The vulnerability exists in three API endpoints within src/backend/base/langflow/api/v1/monitor.py that are missing the required dependencies=[Depends(getcurrentactiveuser)] authentication dependency: Affected Endpoints: 1. GET /api/v1/monitor/messages (Line 61) 2. GET /api/v1/monitor/transactions (Line 183) 3. DELETE /api/v1/monitor/messages/session/{sessionid} (Line 165) Inconsistency Evidence: Other endpoints in the same file properly implement authentication: PoC Complete reproduction steps to demonstrate the vulnerability: Prerequisites: 1. Start a Langflow server instance 2. Ensure no authentication headers or API…
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Overview If an arbitrary path is specified in the request body's fspath, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Vulnerable Code 1. It receives the request body (flow), updates the DB, and then passes it to the file-writing sink. https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L154-L168 2. Applies authentication dependency (requires API Key/JWT) when accessing the endpoint. https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/utils/core.py#L36-L38 3. The client can directly specify the save path, including fspath.…
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Overview Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127.0.0.1, the 10/172/192 ranges) or cloud metadata endpoints (169.254.169.254), and it returns the response body as the result. Because the flow execution endpoints (/api/v1/run, /api/v1/run/advanced) can be invoked with just an API key, if an attacker can control the API Request URL in a flow, non-blind SSRF is possible—accessing internal resources from the server’s network context. This enables requests to, and collection of responses from, internal administrative endpoints, metadata services, and internal databases/services, leading to information disclosure and providing a foothold for further attacks. Vulnerable Code 1. When a flow runs, the API Request URL is set via…
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (alloworigins='' with allowcredentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh accesstoken / refreshtoken pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Recommended action: Upgrade to 1.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This vulnerability was discovered by researchers at Check Point. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed. Summary A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. Details Langflow's Docker image includes a CLI binary at /app/.venv/bin/langflow that exposes sensitive commands, including: langflow superuser This command allows creation of a new superuser without checking whether one already exists. When combined with code execution (e.g., via the authenticated /api/v1/validate/code endpoint), a low-privileged user can execute: /app/.venv/bin/langflow superuser inside the container, and elevate themselves to full…
Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/customcomponent" endpoint and provide a Python script.
Recommended action: Upgrade to 1.0.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.