Most recent entries from all

bdu:2026-06918

EUVD-2026-319935

fkie_cve-2026-33017

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

GHSA-vwmf-pq79-vjvx — Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Affected: PyPI: langflow

## Summary

The `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.

This is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.

## Affected Code

### Vulnerable Endpoint (No Authentication)

**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657

```python @router.post("/build_public_tmp/{flow_id}/flow") async def build_public_tmp( *, flow_id: uuid.UUID, data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED request: Request, # ... NO Depends(get_current_active_user) -- MISSING AUTH ... ): """Build a public flow without requiring authentication.""" client_id = request.cookies.get("client_id") owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)

job_id = await start_flow_build( flow_id=new_flow_id, data=data, # Attacker's data passed directl…

PYSEC-2026-379 — Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Affected: PyPI: langflow

## Summary

## Affected Code

### Vulnerable Endpoint (No Authentication)

**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657

job_id = await start_flow_build( flow_id=new_flow_id, data=data, # Attacker's data passed direct…

WID-SEC-W-2026-0747 — Langflow: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder beliebigen Code auszuführen, was weitere Angriffe ermöglicht.