Threat Intelligence Database

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an unauthenticated attacker to send unauthorized requests from the affected system. Exploitation could lead to network enumeration or assist in other attacks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No patch or remediation information is currently provided by the vendor. The affected versions are explicitly stated as 1.0.0 through 1.11.5.

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a vulnerability that allows a remote authenticated attacker to change the password of an account due to improper authentication controls. This issue does not allow unauthenticated access but requires some level of authentication. The vulnerability impacts the integrity and availability of the affected system. The CVSS score is 5.4, indicating a medium severity level.

A path traversal vulnerability exists in langflow-ai langflow in the 'POST /api/v2/files' endpoint. The 'filename' parameter from multipart form data is not sanitized, allowing attackers to write files to arbitrary filesystem locations using '.. /' sequences. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability due to missing authentication on the registration endpoint. This flaw allows a remote attacker to overwrite administrator email information and misuse the server as an outbound relay. The vulnerability has a high severity rating with a CVSS score of 7.5.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

On June 25, 2026, the first active exploitation of CVE-2026-55255, a critical CVSS 9.9 Langflow vulnerability, was documented. Langflow is an open-source framework for building AI agents and RAG pipelines. A single operator exploited both CVE-2026-55255 (cross-tenant IDOR) and CVE-2026-33017 (unauthenticated RCE, CVSS 9.3) against the same instance. Despite its lower score, the RCE has been exploited thousands of times and is listed in CISA KEV, while the IDOR showed no prior in-the-wild exploitation. The operator focused primarily on the RCE for code execution and implant delivery, using the IDOR opportunistically for credential theft across tenants. The financially motivated threat actor deployed a scripted loader to harvest AWS keys, environment files, and API credentials. This demonstrates that CVSS scores don't always correlate with real-world exploitation rates, as unauthenticated vulnerabilities require less effort than those needing authorization and disclosed object IDs.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.