langflow vulnerabilities — 23 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →

Severity	Vulnerability	Package	Ecosystem	Disclosed	Fixed version
High	Authenticated Remote Code Execution Vulnerability in langflow Package	`langflow`	PyPI	02 Oct 2026	No fix published
7.4 high	Weak Fernet Key Vulnerability in Langflow: Duplicate Advisory	`langflow`	PyPI	05 Aug 2026	No fix published
9.8 critical	Critical Webhook Authentication Bypass in Langflow Package	`langflow`	PyPI	17 Jul 2026	No fix published
6.3 medium	CVE-2026-6599: Langflow Package Vulnerable to Injection in Model Context Protocol Configuration API	`langflow`	PyPI	13 Jul 2026	No fix published
2.7 low	CVE-2026-6597: Langflow Package Suffers from Information Leak Due to Incomplete API Key Redaction	`langflow`	PyPI	13 Jul 2026	No fix published
8.9 high	CVE-2026-0770: Langflow Remote Code Execution Vulnerability via validate_code() exec()	`langflow`	PyPI	07 Jul 2026	No fix published
9.8 critical	CVE-2024-48061: Langflow Remote Code Execution Vulnerability	`langflow`	PyPI	07 Jul 2026	No fix published
3.5 low	CVE-2024-9277: Langflow HTTP POST Request Handler Suffers from Inefficient Regular Expression Complexity	`langflow`	PyPI	07 Jul 2026	No fix published
9.8 critical	CVE-2026-27966: Langflow Remote Code Execution Vulnerability in CSV Agent	`langflow`	PyPI	29 Jun 2026	No fix published
6.3 low	Code Injection Vulnerability in Langflow Package: Prompt Injection Risk	`langflow`	PyPI	03 May 2026	No fix published
6.3 low	CVE-2026-6599: Langflow Injection Vulnerability in Model Context Protocol Configuration API	`langflow`	PyPI	20 Apr 2026	No fix published
2.7 low	CVE-2026-6597: Langflow Package Suffers from Information Leak Due to Incomplete API Key Redaction	`langflow`	PyPI	20 Apr 2026	No fix published
7.5 high	CVE-2026-33484: langflow Unauthenticated IDOR Vulnerability on Image Downloads	`langflow`	PyPI	20 Mar 2026	No fix published
9.3 critical	CVE-2026-33017: Langflow Unauthenticated Remote Code Execution via Public Flow Build Endpoint	`langflow`	PyPI	17 Mar 2026	No fix published
9.8 critical	CVE-2026-27966: Langflow Remote Code Execution Vulnerability in CSV Agent	`langflow`	PyPI	27 Feb 2026	No fix published
8.9 high	CVE-2026-0770: Langflow Remote Code Execution Vulnerability via validate_code() exec()	`langflow`	PyPI	23 Jan 2026	No fix published
8.8 critical	Critical CORS Misconfiguration in Langflow Leads to Account Takeover and RCE	`langflow`	PyPI	06 Dec 2025	No fix published
8.8 high	CVE-2025-34291: Langflow Account Takeover and Remote Code Execution Vulnerability	`langflow`	PyPI	05 Dec 2025	No fix published
8.8 high	CVE-2025-57760: Langflow Privilege Escalation via CLI Superuser Creation	`langflow`	PyPI	25 Aug 2025	No fix published
9.8 medium	CVE-2024-48061: Langflow Remote Code Execution Vulnerability	`langflow`	PyPI	05 Nov 2024	No fix published

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.