Langflow Unauth RCE
Affected range
ECOSYSTEM: introduced 0; fixed 0.3.0Fixed versions: 0.3.0
langflow-base
A Python package with a built-in web application
PyPI latest 1.12.2 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
1.12.2
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
5 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-8c4j-f57c-35cf high
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
Affected range
ECOSYSTEM: introduced 0; fixed 0.5.1Fixed versions: 0.5.1
GHSA-vvfc-fp59-m92g high
Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API
Affected range
ECOSYSTEM: introduced 0; fixed 0.9.1Fixed versions: 0.9.1
GHSA-c5cp-vx83-jhqx high
Langflow Missing Authentication on Critical API Endpoints
Affected range
ECOSYSTEM: introduced 0; fixed 0.7.1Fixed versions: 0.7.1
GHSA-4gv9-mp8m-592r high
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
Affected range
ECOSYSTEM: introduced 0; fixed 0.5.1Fixed versions: 0.5.1