PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55450 langflow-ai CVE debrief

CVE-2026-55450 is a critical vulnerability in Langflow, a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.1, the vulnerability allows unauthenticated users to upload any amount of data to the server without limitations, potentially leading to server space exhaustion. Additionally, the absolute path of the uploaded file is reported to the attacker in the response, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in version 1.9.1.

Vendor
langflow-ai
Product
langflow
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-24
Advisory published
2026-06-23
Advisory updated
2026-06-24

Who should care

Organizations using Langflow versions prior to 1.9.1 should prioritize patching this vulnerability to prevent potential server space exhaustion and information leaks. Security teams and administrators responsible for Langflow deployments should take immediate action to update to version 1.9.1. Additionally, users of Langflow should be aware of the potential risks associated with this vulnerability.

Technical summary

The vulnerability in Langflow allows unauthenticated users to upload arbitrary data without restrictions, potentially leading to server space exhaustion. The vulnerability is caused by a lack of authentication and authorization for data uploads. The response to the upload request also discloses the absolute path of the uploaded file, which can be used to gather information for further attacks. The CVSS score for this vulnerability is 9.3, indicating a critical severity level. The vulnerability is fixed in Langflow version 1.9.1.

Defensive priority

This vulnerability has a high defensive priority due to its critical severity score and potential for server space exhaustion. Immediate patching to version 1.9.1 is recommended.

Recommended defensive actions

  • Update Langflow to version 1.9.1 or later
  • Restrict access to Langflow to only authenticated users
  • Monitor Langflow server space usage for potential exhaustion
  • Review Langflow logs for suspicious upload activity
  • Implement additional security measures to prevent information leaks

Evidence notes

The CVE-2026-55450 vulnerability is documented in the official CVE record and NVD detail pages. The vulnerability is caused by a lack of authentication and authorization for data uploads in Langflow versions prior to 1.9.1. The CVSS score for this vulnerability is 9.3, indicating a critical severity level. The vulnerability is fixed in Langflow version 1.9.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55450 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55450

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55450 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55450

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.