CVE-2026-55450: Langflow unauthenticated upload →

Q: Is CVE-2026-55450 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55450, increasing the risk of exploitation.

Q: How to fix CVE-2026-55450?

1. PATCH: Upgrade Langflow to 1.9.1 or later immediately. The fix adds authenticated flow ownership checks and enforces max_file_size_upload (HTTP 413) on the deprecated endpoint. 2. WORKAROUND (if patching blocked): Block /api/v1/upload/ at the reverse proxy or WAF. Restrict Langflow port (default 7860) to authenticated internal networks — it must never be Internet-facing without an auth layer. 3. DETECT: Check web/access logs for POST requests to /api/v1/upload/ with unauthenticated source IPs. Unusual disk usage spikes in the Langflow cache directory (typically ~/Library/Caches/langflow/ or equivalent) are an IoC. 4. MONITOR: Alert on HTTP 413 spikes post-upgrade as a signal of active exploitation attempts. 5. NOTE: Even after patching, the response still returns the absolute file path to authenticated owners — assess whether this leaks sensitive infrastructure details to legitimate but low-trust users.

Q: What systems are affected by CVE-2026-55450?

This vulnerability affects the following AI/ML architecture patterns: LLM application frameworks, AI agent workflows, Model serving infrastructure, Self-hosted AI orchestration platforms.

Q: What is the CVSS score for CVE-2026-55450?

CVE-2026-55450 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 6.40%.

CISO Take

Langflow's deprecated but still-active file upload endpoint (POST /api/v1/upload/{flow_id}) requires zero authentication — any attacker with network access can upload unlimited data to the server filesystem, exhausting disk space and crashing the AI workflow service. With a CVSS of 9.3 and a trivial one-liner PoC (single curl command, no credentials or prior knowledge required), this is mass-exploitable by unsophisticated threat actors against any Internet-exposed Langflow instance. The endpoint also returns the server's absolute filesystem path in every response, handing attackers a reconnaissance primitive to chain into path traversal or local file inclusion attacks. Langflow already carries 49 tracked CVEs in this codebase, signaling systemic security debt. Upgrade to 1.9.1 immediately; if patching is blocked, WAF-block /api/v1/upload/ and restrict Langflow to authenticated internal networks only.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

Critical risk. CVSS 9.3 (AV:N/AC:L/PR:N/UI:N) reflects the worst-case exposure: zero authentication, zero user interaction, network-accessible from anywhere. Exploitation sophistication is trivial — the PoC is a single curl command. While not yet in CISA KEV, the simplicity of the PoC guarantees rapid weaponization. The information disclosure component (absolute path leakage) elevates the chained risk beyond DoS alone. Langflow is a widely-deployed LLM orchestration framework in enterprise AI pipelines, maximizing blast radius in production environments. The 49 prior CVEs in the same package indicate this is not an isolated finding but a pattern of insufficient security controls.

How does the attack unfold?

Discovery

Attacker scans for Internet-exposed Langflow instances on port 7860 using Shodan, Censys, or active port scanning, identifying the /api/v1/upload/ endpoint from public API documentation.

AML.T0006

Unauthenticated Exploitation

Attacker sends repeated POST requests to /api/v1/upload/{any_uuid} with large file payloads — no credentials or flow knowledge required — exploiting the missing authentication on the deprecated endpoint.

AML.T0049

Path Reconnaissance

Each upload response returns the absolute server filesystem path of the cached file, revealing the server's directory structure and enabling the attacker to map infrastructure for chained attacks.

AML.T0025

Service Disruption

Continued uploads exhaust available disk space on the server, crashing Langflow and all dependent AI agent workflows, LLM pipelines, and orchestration services hosted on the node.

AML.T0029

Discovery

Attacker scans for Internet-exposed Langflow instances on port 7860 using Shodan, Censys, or active port scanning, identifying the /api/v1/upload/ endpoint from public API documentation.

AML.T0006

Unauthenticated Exploitation

Attacker sends repeated POST requests to /api/v1/upload/{any_uuid} with large file payloads — no credentials or flow knowledge required — exploiting the missing authentication on the deprecated endpoint.

AML.T0049

Path Reconnaissance

Each upload response returns the absolute server filesystem path of the cached file, revealing the server's directory structure and enabling the attacker to map infrastructure for chained attacks.

AML.T0025

Service Disruption

Continued uploads exhaust available disk space on the server, crashing Langflow and all dependent AI agent workflows, LLM pipelines, and orchestration services hosted on the node.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.9.1	`1.9.1`
152.4K Pushed 6d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

6.4%

chance of exploitation in 30 days

Higher than 93% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C Low

I None

A High

What should I do?

5 steps

PATCH

Upgrade Langflow to 1.9.1 or later immediately. The fix adds authenticated flow ownership checks and enforces max_file_size_upload (HTTP 413) on the deprecated endpoint.
WORKAROUND (if patching blocked): Block /api/v1/upload/ at the reverse proxy or WAF. Restrict Langflow port (default 7860) to authenticated internal networks — it must never be Internet-facing without an auth layer.
DETECT

Check web/access logs for POST requests to /api/v1/upload/ with unauthenticated source IPs. Unusual disk usage spikes in the Langflow cache directory (typically ~/Library/Caches/langflow/ or equivalent) are an IoC.
MONITOR

Alert on HTTP 413 spikes post-upgrade as a signal of active exploitation attempts.
NOTE

Even after patching, the response still returns the absolute file path to authenticated owners — assess whether this leaks sensitive infrastructure details to legitimate but low-trust users.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Data Leakage Framework Agent AML.T0006 - Active Scanning AML.T0025 - Exfiltration via Cyber Means AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity Art. 9 - Risk management system

ISO 42001

6.1.2 - AI risk treatment 8.4 - AI system technical measures

NIST AI RMF

MANAGE 2.2 - Risk treatment and response

OWASP LLM Top 10

LLM04 - Model Denial of Service LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-55450?

Langflow's deprecated but still-active file upload endpoint (POST /api/v1/upload/{flow_id}) requires zero authentication — any attacker with network access can upload unlimited data to the server filesystem, exhausting disk space and crashing the AI workflow service. With a CVSS of 9.3 and a trivial one-liner PoC (single curl command, no credentials or prior knowledge required), this is mass-exploitable by unsophisticated threat actors against any Internet-exposed Langflow instance. The endpoint also returns the server's absolute filesystem path in every response, handing attackers a reconnaissance primitive to chain into path traversal or local file inclusion attacks. Langflow already carries 49 tracked CVEs in this codebase, signaling systemic security debt. Upgrade to 1.9.1 immediately; if patching is blocked, WAF-block /api/v1/upload/ and restrict Langflow to authenticated internal networks only.

Is CVE-2026-55450 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55450, increasing the risk of exploitation.

How to fix CVE-2026-55450?

1. PATCH: Upgrade Langflow to 1.9.1 or later immediately. The fix adds authenticated flow ownership checks and enforces max_file_size_upload (HTTP 413) on the deprecated endpoint. 2. WORKAROUND (if patching blocked): Block /api/v1/upload/ at the reverse proxy or WAF. Restrict Langflow port (default 7860) to authenticated internal networks — it must never be Internet-facing without an auth layer. 3. DETECT: Check web/access logs for POST requests to /api/v1/upload/ with unauthenticated source IPs. Unusual disk usage spikes in the Langflow cache directory (typically ~/Library/Caches/langflow/ or equivalent) are an IoC. 4. MONITOR: Alert on HTTP 413 spikes post-upgrade as a signal of active exploitation attempts. 5. NOTE: Even after patching, the response still returns the absolute file path to authenticated owners — assess whether this leaks sensitive infrastructure details to legitimate but low-trust users.

What systems are affected by CVE-2026-55450?

This vulnerability affects the following AI/ML architecture patterns: LLM application frameworks, AI agent workflows, Model serving infrastructure, Self-hosted AI orchestration platforms.

What is the CVSS score for CVE-2026-55450?

CVE-2026-55450 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 6.40%.

What is the AI security impact?

Affected AI Architectures

LLM application frameworksAI agent workflowsModel serving infrastructureSelf-hosted AI orchestration platforms

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0025 Exfiltration via Cyber Means

AML.T0029 Denial of AI Service

AML.T0034 Cost Harvesting

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15, Art. 9

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM04, LLM06

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.

Exploitation Scenario

An adversary discovers an Internet-exposed Langflow instance via Shodan or active scanning for port 7860. Without any credentials, they script a loop sending large files to POST /api/v1/upload/{random_uuid}, filling the server disk within minutes. The service crashes or becomes unresponsive, taking down all AI agent workflows and LLM pipelines hosted on that node. Simultaneously, each upload response reveals the absolute path of Langflow's cache directory (e.g., /opt/langflow/cache/ or /home/user/.cache/langflow/), which the attacker uses to infer the deployment's directory structure. If the server also hosts other AI tooling or sensitive model artifacts in adjacent paths, this path leak becomes a pivot point for directory traversal attacks targeting model files, API keys in config files, or training data.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function Primary CWE-400 Uncontrolled Resource Consumption Primary CWE-400 Uncontrolled Resource Consumption Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-306 Missing Authentication for Critical Function CWE-400 Uncontrolled Resource Consumption

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.