Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2026-2030 5 CVEs

Langflow: Mehrere Schwachstellen

Published Jun 21, 2026 · Updated Jul 7, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 5

  • High 8.4
    CVE-2026-55255 Exploited Public exploit

    Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another use…

    langflow-ai langflow langflow PyPI
    KEV Jul 7, 2026
  • Critical 9.6
    CVE-2026-55447

    Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on…

    langflow-ai langflow langflow PyPI
  • High 7.5
    CVE-2026-55446

    Langflow: Unauthenticated DoS through multipart form boundary file upload

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow ap…

    langflow-ai langflow langflow PyPI
  • Medium 6.1
    CVE-2026-55423

    Langflow: Logout button does not clear session

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

    langflow-ai langflow langflow PyPI
  • Medium 5.3
    CVE-2026-12822

    langflow-ai langflow Bundle URL Loader code injection

    A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about t…

    langflow-ai langflow

Revision history

  1. #3

    Aktive Ausnutzung gemeldet

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-38516, EUVD-2026-38517, EUVD-2026-38515, EUVD-2026-38513

  3. #1

    Initiale Fassung

References