CVE-2026-48519

Langflow: Unauthenticated RCE in Shareable Playgrounds

Published Jun 23, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.

Analysis

Technical impact

Langflow is a tool for building and deploying AI‑powered agents and workflows. Prior to version 1.9.2 its Shareable Playground feature permits unauthenticated users to trigger execution of public flows via the /api/v1/build_public_tmp endpoint. The flaw lies in the ability to supply arbitrary Python code in the data.nodes[X].data.node.template.code.value field of the JSON payload, allowing an attacker to run malicious code on the host and achieve full system compromise, a classic example of CWE‑94. This critical RCE vulnerability is fixed in version 1.9.2.

Affected Systems

The vulnerability affects any deployment of langflow‑ai Langflow that is at a version lower than 1.9.2. Any instance exposing the Shareable Playground or Public Flows functionality without authentication is susceptible, regardless of hosting environment.

Risk and Exploitability

The CVSS score of 9.6 indicates critical risk, while the EPSS score is not available, leaving the exact exploitation likelihood unclear. Since the flaw is exploitable without authentication and the endpoint is publicly reachable, attackers can craft a malicious request and trigger code execution. The vulnerability is not yet listed in CISA’s KEV catalog, but the high severity score warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

langflow-ai

langflow

affected

Version	Status	Constraints
`< 1.9.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Langflow

Version	Status	Scheme	Platform
`[0,1.9.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to Langflow 1.9.2 or later to remove the flaw
Disable or protect the Shareable Playground – require authentication before allowing workflow execution
If immediate patching is not possible, remove public flow functionality or block the /api/v1/build_public_tmp endpoint entirely

Generated by OpenCVE AI on June 24, 2026 at 11:02 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-v5ff-9q35-q26f	Langflow: Unauthenticated RCE in Shareable Playgrounds

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.783% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/langflow-ai/langflow/security/advisories/GHSA-v5ff-9q35-q26f

History

Jun 24, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Langflow Langflow langflow
Vendors & Products		Langflow Langflow langflow

Jun 23, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.
Title		Langflow: Unauthenticated RCE in Shareable Playgrounds
Weaknesses		CWE-94
References		https://github.com/langflow-ai/langflow/security/advisories/GHSA-v5ff-9q35-q26f
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}`