2765 matches found
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Summary Langflow OSS is affected by multiple vulnerabilities that could allow a remote attacker to bypass authentication controls, execute arbitrary code, expose application programming interface API credentials, or disclose information through vulnerable dependencies. Issues include an incomplet...
langflow-CVE-2026-33017-poc
CVE-2026-33017 — Langflow Unauthenticated RCE PoC For educational and authorized testing purposes only. Summary Langflow = 1.8.1 exposes a public flow build endpoint that accepts attacker-controlled flow data containing arbitrary code. This code is passed to prepareglobalscope in validate.py, whi...
Sovereign-Echo-33017
Exploit Title: Langflow 1.8.1 - Unauthenticated Remote Code Execution RCE Date: 2026-03-21 Exploit Author: Americo N. F. Simoes SimoesCTT Vendor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: = 1.8.1 Tested on: Linux/Fedora 40 CVE: CVE-2026-330...
CVE-2026-33017
CVE-2026-33017 — Langflow Unauthenticated RCE HoGent CyberSecurity II — Network Pentesting & Exploitation NPE Academic year 2025–2026 Overview This repository contains a complete lab environment and exploitation demonstration of CVE-2026-33017 , a critical unauthenticated Remote Code Execution RC...
cve-2025-3248-exploit
CVE-2025-3248: Langflow Unauthenticated RCE Vulnerability Scanner A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248 , a critical unauthenticated remote code execution vulnerability in Langflow versions ≤ 1.3.0. 🔴 Vulnerability Overview CVE-2025-3248: Langfl...
CVE-2026-93680
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...
CVE-2026-90991
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling...
CVE-2026-77817
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports...
CVE-2026-77819
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...
CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...
CVE-2026-110309
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation...
CVE-2026-110192
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials...
CVE-2026-110193
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...
CVE-2026-110196
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs...
CVE-2026-110200
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information...
CVE-2026-110244
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-110245
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication...
CVE-2026-110190
IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system...