Known Exploited Vulnerabilities May 05, 2025 · CISA KEV Catalog

CVE-2025-3248: Langflow Missing Authentication Vulnerability

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-3248 Langflow
Related: CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026
CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability Known Exploited Vulnerabilities · Jul 07, 2026
CVE-2025-34291: Langflow Origin Validation Error Vulnerability Known Exploited Vulnerabilities · May 21, 2026