CVE-2026-55450Disclosure(langflow / langflow)

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch langflow langflow systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.

langflow CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-200CWE-306CWE-400

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

langflow

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
8 mentions across 7 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 7 signals
Disclosure: 5 classified signals
Peaked 4d ago at 2 mentions (2026-06-23); latest day: 1
8 total mentions across 7 days

Affected systems

Vendors

langflow

Products

langflow

Deep dive

Activity timeline8 mentions / 7d

Signal classification3 categories

Disclosure

562.5%

Patch

225.0%

PoC

112.5%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-19	1	Disclosure1
2026-06-22	1	PoC1
2026-06-23	2	Disclosure2
2026-06-24	1	Disclosure1
2026-06-26	1	Patch1
2026-07-31	1	Disclosure1
2026-10-08	1	Patch1

Full discourse8 posts

FOFA@fofabot131d
Disclosure
⚠️⚠️ CVE-2026-55450: Unauthenticated file upload on Langflow (<1.9.1) enables disk-exhaustion DoS and absolute path disclosure. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJMT0dTUEFDRS1MYW5nRmxvdyI%3D 🎯38.3K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="LOGSPACE-LangFlow" PoC: https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735 #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post announces the new CVE‑2026‑55450 vulnerability on Langflow, highlights a PoC link, and gives technical details of the issue but does not mention exploitation in the wild or available fixes.
014141137.4K
14.6K followersView on X
pdnuclei-bot@pdnuclei_bot94d
Disclosure
🚨 CVE-2026-55450 - critical 🚨 Langflow < 1.9.1 - Unauthenticated File Upload > Langflow < 1.9.1 contains an unrestricted file upload caused by lack of upload limita... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-55450 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2026-55450 as a critical vulnerablity in Langflow versions below 1.9.1, describing it as an unauthenticated file upload; it provides no exploit, PoC, or patch details.
0501341.0K
1.3K followersView on X
Daily CyberSecurity@the_yellow_fall136d
Disclosure
A critical Langflow file upload flaw (CVE-2026-55450) is public with a PoC, enabling unauthenticated denial-of-service and path disclosure. Patch 1.9.1. #Langflow #FileUpload #DoS #Unauthenticated #AISecurity #CyberSecurity #Vulnerability #InfoSec https://securityonline.info/langflow-file-upload-flaw https://t.co/kNzjRh1Haa
Post summary
Langflow’s CVE‑2026‑55450 file‑upload flaw has been publicly disclosed with a PoC, enabling unauthenticated DoS and path disclosure; a patch (v1.9.1) is available.
01021333
12.5K followersView on X
Daily CyberSecurity@the_yellow_fall129d
Patch
Three critical Langflow security vulnerabilities (CVE-2026-55255, CVE-2026-55447, CVE-2026-55450) expose AI applications to RCE and DoS attacks. Patch now. #Langflow #Vulnerability #CyberSecurity #CVE #AppSec https://securityonline.info/langflow-security-vulnerabilities https://t.co/9eNzB5fdOy
Post summary
Three critical Langflow CVEs (CVE-2026-55255, CVE-2026-55447, CVE-2026-55450) allow remote code execution and denial‑of‑service, and users are urged to apply patches immediately.
00020474
12.8K followersView on X
Ash@0xBlackash24d
Patch
🚨 CVE-2026-55450 (Critical 9.3) Langflow < 1.9.1 allows **unauthenticated** file uploads → disk exhaustion (DoS) + absolute path leak. Only network access needed. ✅ Fixed in **1.9.1** Upgrade now if you’re running Langflow. https://github.com/0xBlackash/CVE-2026-55450/ #CyberSecurity #InfoSec https://t.co/n7Q6YNr0lJ
Post summary
The post describes the vulnerability’s impact and identifies version 1.9.1 as the fix, urging users to upgrade. It does not explicitly report a PoC or active exploitation.
0000041
37 followersView on X
Infoflowcloud@infoflowcloud131d
Disclosure
🚨*CVE* CVE-2026-55450 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server witho… https://www.cve.org/CVERecord?id=CVE-2026-55450 ----- Traducción: CVE-2026-55450 Lan… http://infoflow.cloud`
Post summary
CVE-2026-55450 reveals an unauthenticated upload vulnerability in Langflow before version 1.9.1, enabling arbitrary data upload; the CVE record is referenced on cve.org.
0000033
88 followersView on X
CVE@CVEnew131d
Disclosure
CVE-2026-55450 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server witho… https://www.cve.org/CVERecord?id=CVE-2026-55450
Post summary
The post highlights a CVE (CVE-2026-55450) affecting Langflow, noting that unauthenticated users can upload unlimited data to the server in versions before 1.9.1.
00000666
57.7K followersView on X
キタきつね@foxbook133d
PoC
Langflowのファイルアップロードの脆弱性：詳細と概念実証（PoC）エクスプロイトを公開（CVE-2026-55450） Langflow File Upload Flaw: Details and PoC Exploit Publicly Disclosed (CVE-2026-55450) #DailyCyberSecurity (Jun 19) https://securityonline.info/langflow-file-upload-flaw/
Post summary
The text announces that CVE‑2026‑55450, a Langflow file‑upload flaw, has been publicly disclosed with a PoC exploit, but offers no technical details, patch information, or evidence of active exploitation.
00000312
4.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	langflow	langflow	-	-	-

Explore more

Back to dashboard langflow CVEs langflow vulnerabilities

What researchers are saying

CVE-2026-55450

FOFA[verified]@fofabotDisclosure

The post announces the new CVE‑2026‑55450 vulnerability on Langflow, highlights a PoC link, and gives technical details of the issue but does not mention exploitation in the wild or available fixes.

キタきつね[verified]@foxbookPoC

The text announces that CVE‑2026‑55450, a Langflow file‑upload flaw, has been publicly disclosed with a PoC exploit, but offers no technical details, patch information, or evidence of active exploitation.

pdnuclei-bot@pdnuclei_botDisclosure

The tweet announces CVE-2026-55450 as a critical vulnerablity in Langflow versions below 1.9.1, describing it as an unauthenticated file upload; it provides no exploit, PoC, or patch details.

Daily CyberSecurity@the_yellow_fallDisclosure

Langflow’s CVE‑2026‑55450 file‑upload flaw has been publicly disclosed with a PoC, enabling unauthenticated DoS and path disclosure; a patch (v1.9.1) is available.

Daily CyberSecurity@the_yellow_fallPatch

Three critical Langflow CVEs (CVE-2026-55255, CVE-2026-55447, CVE-2026-55450) allow remote code execution and denial‑of‑service, and users are urged to apply patches immediately.

Ash@0xBlackashPatch

The post describes the vulnerability’s impact and identifies version 1.9.1 as the fix, urging users to upgrade. It does not explicitly report a PoC or active exploitation.

Infoflowcloud@infoflowcloudDisclosure

CVE-2026-55450 reveals an unauthenticated upload vulnerability in Langflow before version 1.9.1, enabling arbitrary data upload; the CVE record is referenced on cve.org.

CVE@CVEnewDisclosure

The post highlights a CVE (CVE-2026-55450) affecting Langflow, noting that unauthenticated users can upload unlimited data to the server in versions before 1.9.1.