Langflow
CVE-2025-3248
CRITICAL
GHSA-rvqx-wpfh-mfx7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.8, EPSS 92.1%). Langflow is an increasingly popular LLM orchestration tool. Unauthenticated code execution provides complete server compromise including access to LLM API keys and training data. |
| Exploit ScenarioDerived | An attacker sends a POST request to /api/v1/validate/code containing Python code with os.system() calls. The server executes the code, providing shell access. The attacker extracts API keys for connected LLM services and accesses all workflow data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling attackers to execute arbitrary Python code on the server without authentication.
Earlier versions of this analysis (1)
Langflow's code validation endpoint processes Python code without authentication, allowing unauthenticated attackers to execute arbitrary code. The endpoint intended for code validation actually executes the submitted code.
RemediationAI
Update to Langflow 1.3.0+. Restrict network access to Langflow. Never expose Langflow directly to the internet.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-306 missing authentication on /api/v1/validate/code allows anyone to submit Python code that is executed server-side. The endpoint was designed to validate LangChain component code but executes it in the process.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Executive ViewAI
CVE-2025-3248 presents critical security risk, a missing authentication vulnerability rated CVSS 9.8. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls; (2) Enable MFA where possible; (3) Monitor authentication logs for anomalous access.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers