Security: langflow-ai/langflow
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Unauthenticated RCE in Shareable PlaygroundsGHSA-v5ff-9q35-q26f published
May 27, 2026 by AntonioABLimaCritical -
Unauthenticated file upload leads to DoS (space exhaustion) and information leakGHSA-x223-p2gf-v735 published
Jun 17, 2026 by AntonioABLimaCritical -
Missing Ownership Verification in API Key Deletion (IDOR)GHSA-rf6x-r45m-xv3w published
Mar 16, 2026 by andifilhohubHigh -
Remote Code Execution in CSV AgentGHSA-3645-fxcv-hqr4 published
Feb 25, 2026 by EmpreiteiroCritical -
SSRF in langflow-ai/langflowGHSA-5993-7p27-66g5 published
Dec 19, 2025 by jordanrfrazierHigh -
External Control of File Name or Path in LangflowGHSA-f43r-cc68-gpx4 published
Dec 19, 2025 by jordanrfrazierHigh -
Logout button does not clear sessionGHSA-7hw8-6q6r-4276 published
Jun 19, 2026 by AntonioABLimaModerate -
Missing Authentication on Critical API EndpointsGHSA-c5cp-vx83-jhqx published
Jan 2, 2026 by jordanrfrazierCritical -
Privilege Escalation via CLI Superuser Creation (Post-RCE)GHSA-4gv9-mp8m-592r published
Aug 25, 2025 by jordanrfrazierHigh -
Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership CheckGHSA-8c4j-f57c-35cf published
Mar 25, 2026 by AntonioABLimaHigh