Actively exploited vulnerabilities affecting Langflow products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-0770https://wildfortech.com/security#CVE-2026-0770Langflow, an AI workflow development platform, contains a flaw that lets remote attackers run arbitrary code on affected systems without needing physical access. This is a critical risk because successful exploitation gives an attacker full control over the host, potentially enabling data theft, lateral movement, or ransomware deployment. Any internet-exposed Langflow installation should be treated as high-priority, as no authentication or local access appears to be required for exploitation.Tue, 21 Jul 2026 00:00:00 GMTLangflowLangflowhttps://wildfortech.com/security#CVE-2026-55255https://wildfortech.com/security#CVE-2026-55255Langflow, an AI workflow-building platform, has a flaw that lets any authenticated user run flows owned by other users simply by supplying a different flow ID in their request. This breaks tenant isolation — a malicious insider or compromised account can silently trigger another user's automated workflows, potentially exfiltrating data, abusing integrated services, or disrupting operations without needing elevated privileges beyond basic login credentials.Tue, 07 Jul 2026 00:00:00 GMTLangflowLangflowhttps://wildfortech.com/security#CVE-2025-34291https://wildfortech.com/security#CVE-2025-34291Langflow's overly permissive CORS configuration, combined with its refresh token cookie being set to SameSite=None, allows a malicious website to make credentialed cross-origin requests to the refresh endpoint. An attacker who tricks a logged-in user into visiting a malicious page can silently steal valid session tokens, then use those tokens to access authenticated endpoints and execute arbitrary code — potentially resulting in full system compromise. This is especially serious for organizations using Langflow to orchestrate AI agent workflows with access to sensitive data or infrastructure.Thu, 21 May 2026 00:00:00 GMTLangflowLangflowhttps://wildfortech.com/security#CVE-2026-33017https://wildfortech.com/security#CVE-2026-33017Langflow, an AI workflow-building platform, contains a code injection flaw that lets attackers build and execute public flows without logging in. This means unauthenticated users could potentially run arbitrary code through the platform's flow functionality, bypassing access controls entirely. Organizations running Langflow — especially publicly accessible instances — face a serious risk of unauthorized code execution, data exposure, or system compromise without any credentials being required.Wed, 25 Mar 2026 00:00:00 GMTLangflowLangflow