CVSS: 9.3

Target Service

Langflow

  • A visual workflow tool that allows you to design and execute LLM-based applications in a no-code/low-code manner.
  • GitHub Star 145,000
  • Widely used by companies as an AI workflow automation tool.

Affected Versions

  • Affected Versions: All versions prior to Langflow 1.9.0
  • Patch version: Langflow 1.9.0

Vulnerability Overview

Vulnerability Types

  • RCE
  • Unauthenticated remote code execution
  • Missing authentication
    • The public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow) is accessible without authentication.
  • code injection
    • Arbitrary Python code can be inserted within the flow definition data provided by the attacker.
  • Eval injection
    • Since it is an inserted code, it is passed directly to the exec() function and executed without sandboxing.

Root Cause

  • There was a design flaw in the public flow function.
  • Langflow’s build_public_tmp endpoint is designed to intentionally not require authentication to build public flows. However, this endpoint accepts an optional data parameter, and if this parameter is provided, the flow data provided by the attacker is used instead of the flow data stored in the database.
  • Previously, a patch was implemented in CVE-2025-3248 to add authentication to the /api/v1/validate/code endpoint, but the same exec() call chain also existed in build_public_tmp.
  • build_public_tmp cannot be solved by simply adding authentication to the endpoint for the public flow. If you add authentication, the public flow feature will not work.

Exploitation Mechanism

Attack Flow

  • Attacker → POST /api/v1/build_public_tmp/{flow_id}/flow
    • Include data parameter in request body
    • Inserting arbitrary Python code within note definitions
  • Server-side processing
    • Since the data parameter exists, trusted flow data in the DB is ignored.
    • Flow data provided by the attacker is used as is.
  • Call exec()
  • Execute arbitrary code with server process privileges

When an attacker begins unauthenticated access, the /api/v1/build_public_tmp/{flow_id}/flow endpoint does not require authentication because it is intended to build public flows. An attacker can therefore send an HTTP POST request to this endpoint without credentials.

When calling the exec() function, if an attacker inserts arbitrary code into the note definition within the data, it will be executed with server process privileges without verification or isolation, resulting in RCE.

Patch Details

Langflow 1.9.0

Completely remove data parameter from public endpoints (so that public flows can only execute trusted flow data stored in server-side database)

  • In Langflow 1.9.0, in addition to this vulnerability, a related vulnerability (RCE through file upload path discovery), CVE-2026-33309, was also patched.