en
Langflow AI is the open-source project and maintainer community for Langflow, a Python-based platform in the AI application development field. Its core mission is to help developers build, test, and deploy AI-powered agents and workflows through visual components, APIs, and extensible code. It operates as a global open-source software project.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/16/2026, langflow-ai recorded 6 security vulnerabilities in the last 90 days across 3 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, langflow had the most security vulnerabilities in the langflow-ai ecosystem, with 6 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-105741Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration WriteCVE-2026-105740Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverCVE-2026-105699Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersCVE-2026-105698Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpointsCVE-2026-105697Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration42 Results | Page 1 of 5
| SeverityCritical |
| SeverityHigh |
| SeverityMedium |
| SeverityCritical |
| SeverityLow |
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |