Langflow: Unauthenticated RCE in Shareable Playgrounds
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-48519
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.
Description quoted from the NVD record.
Who is affected
Langflow is a tool for building and running apps and assistants that use AI language models. This flaw affects versions before 1.9.2 and involves the Shareable Playground feature, which lets people run a shared workflow just by opening a link, without logging in. Anyone who has the identifier of a workflow shared this way could slip their own program code into the request, and Langflow would run it, without the attacker needing an account. This flaw is rated Critical.
What to do
- Find out who installed or runs Langflow for your organization: a staff member, a volunteer, or an IT provider or vendor who manages it for you.
- If you run Langflow yourself, update it to version
1.9.2or later, which fixes this flaw. - If an IT provider or vendor runs Langflow for you, send them this advisory and ask when the update to
1.9.2will be done. - If you are unsure which version you have, ask whoever runs Langflow to check its version number. Any version before
1.9.2has this flaw.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.