Langflow CVE-2026-13448

Exploitation requires that the target Langflow OSS instance (version 1.0.0-1.10.1) has the public flow build endpoint /api/v1/build_public_tmp/{flow_id}/flow reachable by the attacker, and that a public flow can be submitted or built containing one of the un-denylisted code-execution agent components (specifically OpenDsStarAgent, CodeActAgentSmolagents, or CSVAgent). Per CVSS PR:N/UI:N, no authentication or user interaction is needed. The primary limiting factor is deployment exposure: instances that do not enable/serve public flows, or that restrict access to the build_public_tmp path, are not remotely exploitable by anonymous users; version must also be within the 1.0.0-1.10.1 range.

Signals are largely consistent toward high priority but with one tension worth noting. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes the worst case: remote, unauthenticated, no user interaction, full triad impact - a textbook internet-exploitable RCE. Against that, the EPSS score is low (0.44%, 36th percentile) and there is no CISA KEV listing and no identified public exploit, which tempers immediacy: the flaw is trivially exploitable in principle but not yet evidenced as widely weaponized. The critical caveat is exposure - the vulnerable endpoint is a 'public flow' feature, so real-world risk depends on whether an instance actually exposes public flows and is reachable from untrusted networks; internal-only or non-public-flow deployments face materially lower exposure than the raw 9.8 implies. Net: treat as high priority for any Langflow instance exposed to untrusted users, while recognizing exploitation is currently opportunistic rather than mass-scale.

An attacker discovers an internet-reachable Langflow OSS instance (≤1.10.1) with public flows enabled and submits a crafted flow to /api/v1/build_public_tmp/{flow_id}/flow that embeds a code-execution agent such as CodeActAgentSmolagents or CSVAgent. Because validate_public_flow_no_code_execution() does not block these components, the flow builds and executes the attacker's code on the server with no authentication or user interaction. No public exploit is identified at time of analysis, but the low attack complexity means a working exploit is straightforward to develop.