CVE-2025-3248
Langflow Missing Authentication Vulnerability
Published Apr 7, 2025 · updated Oct 8, 2026 · langflow langflow
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Timeline
Detection, updates, and resolution for this record.
Apr 7, 2025 · Catalog
Detected
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
May 5, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
May 26, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Oct 8, 2026 · Catalog
Updated
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date May 26, 2025
Affected
- cpe langflow/langflowversion unspecified
- vendor Langflow Langflowversion unspecified
Sources
- CISA KEVCVE-2025-3248
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
cisa.gov - CVE.orgCVE-2025-3248
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-3248
30-day exploitation probability 100.0%
first.org - Exploit Database52262
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database52364
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/langflow_unauth_rce_cve_2025_3248
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2025-3248
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
nvd.nist.gov