Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation
Priority HIGH 73CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Fixed langflow (PyPI): 1.5.1langflow-base (PyPI): 0.5.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Langflow | langflow | up to 1.5.0 | — | No fix listed | CNA |
| — | langflow (PyPI) | before 1.5.1 | 1.5.1 | Patch available | GHSA-4gv9-mp8m-592r |
| — | langflow-base (PyPI) | before 0.5.1 | 0.5.1 | Patch available | GHSA-4gv9-mp8m-592r |
- langflow VendorLangflow Affected up to 1.5.0 Fixed in — No fix listed CNA
- langflow (PyPI) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-4gv9-mp8m-592r
- langflow-base (PyPI) Vendor— Affected before 0.5.1 Fixed in 0.5.1 Patch available GHSA-4gv9-mp8m-592r
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* | before 1.5.0 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev0:*:*:*:*:*:* | 1.5.0 dev0 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev1:*:*:*:*:*:* | 1.5.0 dev1 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev10:*:*:*:*:*:* | 1.5.0 dev10 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev11:*:*:*:*:*:* | 1.5.0 dev11 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev12:*:*:*:*:*:* | 1.5.0 dev12 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev13:*:*:*:*:*:* | 1.5.0 dev13 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev14:*:*:*:*:*:* | 1.5.0 dev14 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev15:*:*:*:*:*:* | 1.5.0 dev15 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev16:*:*:*:*:*:* | 1.5.0 dev16 | Vulnerable | Langflow |
- cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev0:*:*:*:*:*:* Versions 1.5.0 dev0 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev1:*:*:*:*:*:* Versions 1.5.0 dev1 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev10:*:*:*:*:*:* Versions 1.5.0 dev10 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev11:*:*:*:*:*:* Versions 1.5.0 dev11 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev12:*:*:*:*:*:* Versions 1.5.0 dev12 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev13:*:*:*:*:*:* Versions 1.5.0 dev13 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev14:*:*:*:*:*:* Versions 1.5.0 dev14 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev15:*:*:*:*:*:* Versions 1.5.0 dev15 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev16:*:*:*:*:*:* Versions 1.5.0 dev16 Vulnerable ·Langflow
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:langflow:langflow:1.5.0:dev17:*:*:*:*:*:* | 1.5.0 dev17 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev18:*:*:*:*:*:* | 1.5.0 dev18 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev19:*:*:*:*:*:* | 1.5.0 dev19 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev2:*:*:*:*:*:* | 1.5.0 dev2 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev20:*:*:*:*:*:* | 1.5.0 dev20 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev21:*:*:*:*:*:* | 1.5.0 dev21 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev22:*:*:*:*:*:* | 1.5.0 dev22 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev23:*:*:*:*:*:* | 1.5.0 dev23 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev24:*:*:*:*:*:* | 1.5.0 dev24 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev25:*:*:*:*:*:* | 1.5.0 dev25 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev26:*:*:*:*:*:* | 1.5.0 dev26 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev27:*:*:*:*:*:* | 1.5.0 dev27 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev28:*:*:*:*:*:* | 1.5.0 dev28 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev29:*:*:*:*:*:* | 1.5.0 dev29 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev3:*:*:*:*:*:* | 1.5.0 dev3 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev30:*:*:*:*:*:* | 1.5.0 dev30 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev31:*:*:*:*:*:* | 1.5.0 dev31 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev4:*:*:*:*:*:* | 1.5.0 dev4 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev5:*:*:*:*:*:* | 1.5.0 dev5 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev6:*:*:*:*:*:* | 1.5.0 dev6 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev7:*:*:*:*:*:* | 1.5.0 dev7 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev8:*:*:*:*:*:* | 1.5.0 dev8 | Vulnerable | Langflow |
| cpe:2.3:a:langflow:langflow:1.5.0:dev9:*:*:*:*:*:* | 1.5.0 dev9 | Vulnerable | Langflow |
- cpe:2.3:a:langflow:langflow:1.5.0:dev17:*:*:*:*:*:* Versions 1.5.0 dev17 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev18:*:*:*:*:*:* Versions 1.5.0 dev18 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev19:*:*:*:*:*:* Versions 1.5.0 dev19 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev2:*:*:*:*:*:* Versions 1.5.0 dev2 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev20:*:*:*:*:*:* Versions 1.5.0 dev20 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev21:*:*:*:*:*:* Versions 1.5.0 dev21 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev22:*:*:*:*:*:* Versions 1.5.0 dev22 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev23:*:*:*:*:*:* Versions 1.5.0 dev23 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev24:*:*:*:*:*:* Versions 1.5.0 dev24 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev25:*:*:*:*:*:* Versions 1.5.0 dev25 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev26:*:*:*:*:*:* Versions 1.5.0 dev26 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev27:*:*:*:*:*:* Versions 1.5.0 dev27 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev28:*:*:*:*:*:* Versions 1.5.0 dev28 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev29:*:*:*:*:*:* Versions 1.5.0 dev29 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev3:*:*:*:*:*:* Versions 1.5.0 dev3 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev30:*:*:*:*:*:* Versions 1.5.0 dev30 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev31:*:*:*:*:*:* Versions 1.5.0 dev31 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev4:*:*:*:*:*:* Versions 1.5.0 dev4 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev5:*:*:*:*:*:* Versions 1.5.0 dev5 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev6:*:*:*:*:*:* Versions 1.5.0 dev6 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev7:*:*:*:*:*:* Versions 1.5.0 dev7 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev8:*:*:*:*:*:* Versions 1.5.0 dev8 Vulnerable ·Langflow
- cpe:2.3:a:langflow:langflow:1.5.0:dev9:*:*:*:*:*:* Versions 1.5.0 dev9 Vulnerable ·Langflow
Remediation
- Fix · GHSA-4gv9-mp8m-592r langflow (PyPI) Fixed in 1.5.1 Advisory →
- Fix · GHSA-4gv9-mp8m-592r langflow-base (PyPI) Fixed in 0.5.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57760
- 2026-10-03 Alias added: GHSA-4gv9-mp8m-592r
References
Patch 2
More Langflow vulnerabilities
- TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
- TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
- TI-2025-24427 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE KEVCVSS 4.0CRITICAL 9.4
- TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
- TI-2026-25463 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint KEVCVSS 4.0CRITICAL 9.3
- TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2025-57760 · CVE Program
- CVE-2025-57760 · NVD
- FIRST EPSS
- GHSA-4gv9-mp8m-592r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences