Unauthenticated file upload DoS and information leak in Langflow (CVE-2026-55450)

The deprecated `POST /api/v1/upload/{flow_id}` endpoint in Langflow requires no authentication and imposes no file size or rate limits, allowing any network-accessible party to exhaust server disk space and cause denial of service. The endpoint also returns the absolute path of the uploaded file in its response, leaking the server's cache directory layout to unauthenticated attackers. Public POC available. Affected versions: - < 1.9.1 We recommend updating to: >= 1.9.1. CVSS 9.3 · our assessment: act_now Reference: https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735 Details: https://vuln.today/cve/CVE-2026-55450