[UPDATE] [high] Langflow: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities allow an attacker to execute arbitrary code, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.

Who is affected

Deployments of Langflow are affected by these vulnerabilities.

Urgency

Remediation is urgent due to the high severity and confirmed exploitation of these vulnerabilities.

Action

Apply the latest security updates to Langflow.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-07-08

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2030

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-128220.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
• Exploitation confirmedCVE-2026-55255Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 57% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-554230.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-554460.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-554470.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownexploitedLangflow security advisory (AV26-670)cccs
• highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
• criticalexploitedCVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerabilitycisa-kev
• highexploitedGHSA-qrpv-q767-xqq2: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attacke…ghsa

Recent advisories for Langflow

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[NEW] [high] Langflow OSS: Multiple Vulnerabilitiescert-bund · 2026-08-25
• high[NEW] [high] Langflow OSS: Multiple vulnerabilitiescert-bund · 2026-08-24
• medium[NEW] [medium] IBM Langflow Desktop: Vulnerability enables bypassing security measures and data manipulationcert-bund · 2026-08-20
• highCVE-2026-19875: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator…nvd · 2026-08-19
• medium[NEW] [medium] Langflow: Vulnerability enables bypass of security measures and manipulation of datacert-bund · 2026-08-14
• high[NEW] [high] IBM Langflow Desktop: Vulnerability enables bypass of security measurescert-bund · 2026-08-14

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
• medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
• medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25