Langflow Multiple Security Vulnerabilities - CVSS 8.8

CERT-Bund published advisory WID-SEC-2026-0900 identifying multiple security vulnerabilities in Open Source Langflow (versions unspecified) affecting UNIX, Windows, and other operating systems. The flaws allow remote, anonymous or authenticated attackers to exploit information disclosure, data manipulation, and XSS vulnerabilities. Affected parties include organizations using Langflow for LLM-based application development.

Organizations using Langflow should immediately identify if they have deployments affected by these vulnerabilities. Since no mitigation is currently available, entities should monitor for vendor patches, consider workarounds if available, and implement detection controls for exploitation attempts. Priority should be given to internet-facing Langflow instances due to the remote attack vector.