Langflow: Unauthenticated DoS through multipart form boundary file upload
Langflow
More for Langflow RSS feed for Langflow
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-55446
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 25, 2026
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.
Description quoted from the NVD record.
Who is affected
Langflow, a tool for building and running apps and automated workflows that use AI language models, has a flaw in its file upload feature. This flaw affects all versions before 1.0.19. An attacker does not need to log in or have any account. By sending a specially shaped file upload request over the network, they can make Langflow unusable for everyone who uses it, for an indefinite amount of time. This flaw is rated High.
What to do
- Find out who runs Langflow for your organization. If you or a staff member installed it, that person should act. If an IT provider or vendor manages it, they should act.
- The person who runs Langflow should update it to version
1.0.19or later, which fixes this flaw. - If an IT provider or vendor runs Langflow for you, send them this advisory and ask when the update will be done.
- If you are not sure which version you have, ask the person who installed it to check whether it is older than
1.0.19.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.