CVE-2025-3248
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. EPSS 100% (100th percentile).
CISA federal remediation date May 26 · date passed
AI Security · Web App Attack
VulnCheck says it has seen two threat actors use different exploitation techniques against Langflow, with more than 15,000 successful attempts tied to CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. The open source AI workflow builder is being targeted through more than one weakness at the same time, not one isolated bug.
One path abuses a validation endpoint to inject code; another abuses file upload handling to write files on the server. In both cases, a normal web request becomes host control, so fixing one CVE does not close the whole compromise path if the service stays exposed.
That matters most for internet-facing AI workflow platforms and other low-code builders: the exposure sits in the host and the app layer together, and attackers can come back through a different flaw even after one patch lands. VulnCheck also says hundreds of Langflow hosts are still online and vulnerable, so the problem here is persistent reachability, not a single missed update.
1 source · Aug 28
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. EPSS 100% (100th percentile).
CISA federal remediation date May 26 · date passed
CVSS 8.8 HIGH: the 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing… EPSS 5% (92nd percentile).
VulnCheck
Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack | Blog | VulnCheck
A look into real threat actor activity targeting Langflow hosts using different techniques and tactics.
originalPart of the PlainSec briefing for 2026-08-28
Every edition of this story: Langflow Faces Two Paths to Host Takeover