Vulnerabilities in langflow-ai
42 resultsCVE-2026-55446HIGHLangflow: Unauthenticated DoS through multipart form boundary file uploadEPSS 0.6%CVE-2025-57760HIGHLangflow Vulnerable to Privilege Escalation via CLI Superuser CreationEPSS 0.5%CVE-2026-33760HIGHLangflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 EndpointsEPSS 0.5%CVE-2026-34046HIGHLangflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership CheckEPSS 0.5%CVE-2026-42867MEDIUMLangflow: Path Traversal in Knowledge Bases API via Creation EndpointEPSS 0.5%CVE-2026-48520MEDIUMLangflow: Unauthenticated Shareable Playground arbitrary local or S3 file readEPSS 0.4%CVE-2026-33053MEDIUMLangflow has Missing Ownership Verification in API Key Deletion (IDOR)EPSS 0.4%CVE-2026-6597MEDIUMlangflow-ai langflow Flow Using API core.py has_api_terms credentials storageEPSS 0.4%CVE-2026-7700MEDIUMlangflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injectionEPSS 0.3%CVE-2026-105699HIGHLangflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersEPSS 0.3%CVE-2026-6596MEDIUMlangflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted uploadEPSS 0.3%CVE-2026-12822MEDIUMlangflow-ai langflow Bundle URL Loader code injectionEPSS 0.3%CVE-2026-5025MEDIUMLangflow - Application Logs Exposed to All Authenticated UsersEPSS 0.3%CVE-2026-105741HIGHLangflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration WriteEPSS 0.2%CVE-2026-6599MEDIUMlangflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injectionEPSS 0.2%CVE-2026-105698MEDIUMLangflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpointsEPSS 0.2%CVE-2026-55423MEDIUMLangflow: Logout button does not clear sessionEPSS 0.2%CVE-2026-5022MEDIUMLangflow - Missing Authorization on download_image EndpointEPSS 0.2%CVE-2026-101861LOWLangflow Code Execution via eval() in Component Input SchemaEPSS 0.2%CVE-2026-6600MEDIUMlangflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scriptingEPSS 0.2%