CVE-2025-3248
Langflow Missing Authentication Vulnerability
Description
CVE-2025-3248 is a critical code injection vulnerability in Langflow, an open-source platform for building AI-powered applications and workflows. Versions prior to 1.3.0 contain an unauthenticated code injection flaw in the /api/v1/validate/code endpoint that allows a remote attacker to execute arbitrary code on the server without any authentication. With a CVSS v3.1 base score of 9.8 (Critical), this vulnerability provides a direct path to complete server compromise. CISA added CVE-2025-3248 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 26, 2025, and its EPSS score of 92.43% at the 99th percentile indicates near-certain exploitation for any exposed Langflow instance.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| langflow | langflow | < 1.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/langflow-ai/langflow/pull/6911(Patch)
- https://github.com/langflow-ai/langflow/releases/tag/1.3.0(Release Notes)
- https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/(Exploit, Third Party Advisory)
- https://www.vulncheck.com/advisories/langflow-unauthenticated-rce(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3248(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
The /api/v1/validate/code endpoint in Langflow performs code validation without requiring any form of authentication, exposing a critical server function to unauthenticated remote access. This missing authentication check allows any network-reachable attacker to interact with the code execution functionality.
Learn more: CWE-306 — Missing Authentication for Critical Function
CWE-94: Code Injection
CVE-2025-3248 also involves CWE-94, Improper Control of Generation of Code (Code Injection). The vulnerability allows an attacker to inject arbitrary Python code through the code validation endpoint, which the server then executes. The lack of input sanitization in the code validation logic enables direct injection and execution of attacker-supplied code.
Learn more: CWE-94 — Code Injection
Impact Analysis
CVE-2025-3248 carries the maximum-severity CVSS v3.1 score of 9.8 (Critical), reflecting a devastatingly exploitable vulnerability. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), with high impact across all three dimensions. Confidentiality is completely compromised as arbitrary code execution grants the attacker full access to all data on the Langflow server, including AI model configurations, API keys for connected services, training data, and user information. Integrity faces maximum risk because the attacker can modify AI workflows, inject malicious logic into AI pipelines, alter model outputs, and install persistent backdoors. Availability is at high risk as the attacker can shut down the Langflow service, consume server resources, or destroy data. The EPSS score of 92.43% at the 99th percentile represents near-certain exploitation, making this one of the most urgently actionable vulnerabilities for any organization running Langflow. Given Langflow's role in AI application development, compromise could also enable supply chain attacks against downstream AI applications.
Exploit Maturity
CVE-2025-3248 has reached maximum exploit maturity with near-universal exploitation probability. Public exploit code and detailed technical analysis is available from Horizon3.ai's disclosure on abusing Python exec for unauthenticated RCE in Langflow, which provides a thorough walkthrough of the exploitation technique. CISA confirmed active exploitation by adding CVE-2025-3248 to the Known Exploited Vulnerabilities catalog on May 5, 2025. The EPSS score of 92.43% at the 99th percentile is one of the highest scores possible, indicating near-certain exploitation for any exposed instance. The straightforward nature of the exploit, sending crafted Python code to an unauthenticated endpoint, makes it trivially automatable and accessible to attackers of all skill levels.
Remediation
-
Upgrade Langflow to version 1.3.0 or later immediately. The Langflow 1.3.0 release resolves this vulnerability. The fix is also documented in pull request #6911.
-
If immediate upgrade is not possible, restrict network access to the Langflow instance by placing it behind a reverse proxy with authentication or limiting access to trusted IP ranges through firewall rules. The
/api/v1/validate/codeendpoint must not be accessible to untrusted networks. -
Audit Langflow instances for signs of compromise. Review server logs for unexpected requests to the
/api/v1/validate/codeendpoint, check for unauthorized files, processes, or network connections, and examine AI workflow configurations for unauthorized modifications. -
Rotate all credentials and API keys accessible from the Langflow server, including API keys for connected AI services (OpenAI, Anthropic, etc.), database credentials, and any secrets stored in environment variables or configuration files.
-
Implement network monitoring and web application firewall rules to detect and block exploitation attempts targeting the code validation endpoint, and establish ongoing alerting for unauthorized access patterns to Langflow API endpoints.
Technical Details
CVE-2025-3248 combines two critical weaknesses in Langflow versions prior to 1.3.0: missing authentication (CWE-306) and code injection (CWE-94). The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum exploitability of this unauthenticated remote code execution vulnerability. The vulnerable endpoint /api/v1/validate/code is designed to validate user-provided Python code as part of Langflow's AI workflow building functionality. However, the validation process uses Python's exec() function to evaluate the submitted code without authentication and without adequate sandboxing or input restrictions. An attacker can send a crafted HTTP request containing arbitrary Python code to this endpoint, which the server executes with the full privileges of the Langflow application process. This typically provides complete access to the server's file system, network connectivity, and all resources accessible to the Langflow process including AI service API keys, database connections, and user data. The fix in version 1.3.0 adds authentication requirements to the endpoint and implements proper code validation that does not involve direct execution.
Frequently Asked Questions
Is CVE-2025-3248 being actively exploited?
Yes. CVE-2025-3248 is actively exploited in the wild, as confirmed by CISA's KEV catalog listing on May 5, 2025. Public exploit code is available from Horizon3.ai, and the EPSS score of 92.43% at the 99th percentile indicates near-certain exploitation for any exposed instance.
What products are affected by CVE-2025-3248?
Langflow versions prior to 1.3.0 are vulnerable. Langflow is an open-source platform for building AI-powered applications and workflows using a visual interface and Python-based flow components.
How do I fix CVE-2025-3248?
Upgrade Langflow to version 1.3.0 or later, which adds authentication to the vulnerable endpoint. If immediate upgrade is not possible, restrict network access to the Langflow instance and ensure it is not exposed to untrusted networks.
How severe is CVE-2025-3248?
CVE-2025-3248 is rated Critical with a CVSS score of 9.8, representing unauthenticated remote code execution. The 92.43% EPSS score at the 99th percentile makes it one of the most dangerous actively exploited vulnerabilities, particularly for organizations using Langflow in production environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.