CVE-2026-48520: Langflow unauth file read

CISO Take

Langflow's Shareable Playground feature contains an unauthenticated arbitrary file read: any public flow execution request can include attacker-controlled file paths that Langflow reads from the local filesystem or S3 and feeds directly into the configured LLM. Despite a CVSS 6.1 medium score, the actual vector shows zero authentication or privileges required with HIGH confidentiality impact — an attacker needs only a public flow link and browser developer tools to exfiltrate .env credentials, LLM API keys, database connection strings, or S3 object contents. With Langflow accumulating 48 CVEs and the PoC requiring trivial effort (editing a single JSON field in a cURL request), any organization running Langflow with shared flows should treat this as urgent regardless of EPSS. Patch to 1.10.0 immediately, disable Shareable Playground if patching is delayed, and rotate all credentials stored in files accessible to the Langflow process.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

CVSS 6.1 materially understates operational risk. The attack vector is fully network-accessible with no authentication, no privileges, and only a nominal UI interaction requirement (a flow must have been shared). Confidentiality impact is HIGH — the read primitive targets any file readable by the Langflow OS process, including .env files containing LLM API keys (OpenAI, Anthropic), database credentials, model weights, and S3 paths if cloud storage is configured. EPSS is low (0.00054) but the trivially reproducible PoC — modify one JSON field in a captured cURL request — sets an extremely low exploitation barrier once the advisory is public. Langflow's history of 48 CVEs indicates systemic security debt; this vulnerability should trigger a broader framework risk review rather than a point patch.

How does the attack unfold?

Discovery

Adversary identifies an internet-exposed Langflow instance with public flows enabled via Shodan scanning for port 7860 or known Langflow UI fingerprints.

AML.T0006

Initial Access

Adversary accesses a Shareable Playground link without credentials and captures the unauthenticated /api/v1/build_public_tmp API request using browser developer tools.

AML.T0049

File Read

Adversary modifies the 'files' JSON field in the captured request to point to sensitive server-side paths such as .env, /etc/passwd, or S3 URIs and replays the request.

AML.T0037

Exfiltration

Langflow reads the targeted file and passes its contents to the configured LLM as an image input; the LLM response relays the file contents including credentials and secrets back to the adversary.

AML.T0086

Discovery

Adversary identifies an internet-exposed Langflow instance with public flows enabled via Shodan scanning for port 7860 or known Langflow UI fingerprints.

AML.T0006

Initial Access

Adversary accesses a Shareable Playground link without credentials and captures the unauthenticated /api/v1/build_public_tmp API request using browser developer tools.

AML.T0049

File Read

Adversary modifies the 'files' JSON field in the captured request to point to sensitive server-side paths such as .env, /etc/passwd, or S3 URIs and replays the request.

AML.T0037

Exfiltration

Langflow reads the targeted file and passes its contents to the configured LLM as an image input; the LLM response relays the file contents including credentials and secrets back to the adversary.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.10.0	`1.10.0`
152.7K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Changed

C High

I None

A None

What should I do?

6 steps

Patch: upgrade Langflow to >= 1.10.0 which resolves CWE-73 in the public flow execution path.
If patching is delayed, immediately disable all Shareable Playground / Public Flow configurations via the Langflow admin panel and revoke existing public share links.
Restrict filesystem permissions: run Langflow under a dedicated low-privilege service account with read access scoped only to the required upload/temp directory; deny access to .env, credential stores, and config files via OS-level controls (chmod 600, SELinux/AppArmor profiles).
Rotate all credentials and API keys in files accessible to the Langflow process (LLM provider keys, DB connection strings, cloud storage tokens).
Detection: monitor HTTP access logs for POST requests to /api/v1/build_public_tmp containing file paths outside the expected upload directory; alert on patterns like .env, /etc/, /home/, /root/, s3://.
If S3 is integrated, apply IAM least-privilege and enable S3 server-access logging to detect unexpected object reads.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Data Leakage Auth Bypass Framework Agent AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0085 - Data from AI Services AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - Risk treatment

NIST AI RMF

MANAGE-2.4 - Residual risks are managed

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-48520?

Langflow's Shareable Playground feature contains an unauthenticated arbitrary file read: any public flow execution request can include attacker-controlled file paths that Langflow reads from the local filesystem or S3 and feeds directly into the configured LLM. Despite a CVSS 6.1 medium score, the actual vector shows zero authentication or privileges required with HIGH confidentiality impact — an attacker needs only a public flow link and browser developer tools to exfiltrate .env credentials, LLM API keys, database connection strings, or S3 object contents. With Langflow accumulating 48 CVEs and the PoC requiring trivial effort (editing a single JSON field in a cURL request), any organization running Langflow with shared flows should treat this as urgent regardless of EPSS. Patch to 1.10.0 immediately, disable Shareable Playground if patching is delayed, and rotate all credentials stored in files accessible to the Langflow process.

Is CVE-2026-48520 actively exploited?

No confirmed active exploitation of CVE-2026-48520 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-48520?

1. Patch: upgrade Langflow to >= 1.10.0 which resolves CWE-73 in the public flow execution path. 2. If patching is delayed, immediately disable all Shareable Playground / Public Flow configurations via the Langflow admin panel and revoke existing public share links. 3. Restrict filesystem permissions: run Langflow under a dedicated low-privilege service account with read access scoped only to the required upload/temp directory; deny access to .env, credential stores, and config files via OS-level controls (chmod 600, SELinux/AppArmor profiles). 4. Rotate all credentials and API keys in files accessible to the Langflow process (LLM provider keys, DB connection strings, cloud storage tokens). 5. Detection: monitor HTTP access logs for POST requests to /api/v1/build_public_tmp containing file paths outside the expected upload directory; alert on patterns like .env, /etc/, /home/, /root/, s3://. 6. If S3 is integrated, apply IAM least-privilege and enable S3 server-access logging to detect unexpected object reads.

What systems are affected by CVE-2026-48520?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, agent frameworks, RAG pipelines, AI development environments, model serving.

What is the CVSS score for CVE-2026-48520?

CVE-2026-48520 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestrationagent frameworksRAG pipelinesAI development environmentsmodel serving

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0085 Data from AI Services

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: 8.4

NIST AI RMF: MANAGE-2.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.

Exploitation Scenario

An adversary scans internet-exposed Langflow instances (Shodan search for port 7860 or known Langflow UI fingerprints) and identifies one with at least one public flow. Using a browser, they execute the flow through the Shareable Playground link with DevTools open, capture the POST to /api/v1/build_public_tmp, and replay it with the files field modified to point to /app/.env or /opt/langflow/.env. Langflow reads the file and passes its contents to the configured LLM — e.g., GPT-4V — as an image attachment. The LLM describes the 'image' contents, inadvertently returning OPENAI_API_KEY=sk-..., DATABASE_URL=postgres://..., and S3 credentials. With these secrets the adversary pivots to connected LLM APIs (running up fraudulent charges), the backend database, or S3 buckets containing proprietary training data or model artifacts. The entire attack requires no account, no prior access, and approximately 5 minutes from discovery to credential exfiltration.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.