CVE-2026-554509.3CriticalCWE-200
langflow-ai langflow vulnerability
langflow-ai · langflow
Not in CISA KEVVendor fix available
1.2%probability of exploitation in the next 30 days
67th percentile
050100
Higher than 67% of scored CVEs
9.3CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.
Coverage2 articles · 1 outlet
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 19 Jun.
Quiet for 18 weekslast report 26 Jun2 articles1 outlet
- Fri 19 Jun, 02:21 UTC. SecurityOnline, first report. Langflow File Upload Flaw: Details and PoC Exploit Publicly Disclosed (CVE-2026-55450).
- Fri 26 Jun, 02:20 UTC. SecurityOnline. Critical flaws in Langflow allow data theft and DoS, patch urged.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 19 Jun 02:21 | SecurityOnline | Langflow File Upload Flaw: Details and PoC Exploit Publicly Disclosed (CVE-2026-55450) |
| 26 Jun 02:20 | SecurityOnline | Critical flaws in Langflow allow data theft and DoS, patch urged |
- Critical flaws in Langflow allow data theft and DoS, patch urgedSecurityOnline · mentions it in passing
- Langflow File Upload Flaw: Details and PoC Exploit Publicly Disclosed (CVE-2026-55450)SecurityOnline · first in our coverage
New articles also arrive in the RSS feed.