CVE-2026-55450: 
Homebrew vulnerability analysis and mitigation

CVE-2026-55450 is an unauthenticated file upload vulnerability in Langflow, a tool for building and deploying AI-powered agents and workflows, that allows remote attackers to exhaust server storage and leak filesystem path information. The vulnerability affects all Langflow versions prior to 1.9.1 and was discovered by security researcher Ori Lahav of Rubrik Inc. It was published on June 17, 2026, with the fix merged on April 22, 2026, and released in version 1.9.1. The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is a missing authentication check (CWE-306) on the deprecated POST /api/v1/upload/{flow_id} endpoint in langflow/api/v1/endpoints.py. Although the endpoint was marked deprecated=True and include_in_schema=False (hiding it from API documentation), the route remained fully live and accessible in production. The endpoint accepted any UUID as flow_id without validation and passed uploaded files directly to save_uploaded_file(), which persisted them to the local filesystem under a folder named after the supplied UUID. The server response included the absolute path of the saved file (e.g., /Users/ori/Library/Caches/langflow/<uuid>/<sha256>.txt), constituting an information leak (CWE-200) that could assist in chaining further attacks. No prior knowledge of the system was required — only network access to the Langflow instance (GitHub Advisory, Fix PR).

Successful exploitation enables an unauthenticated attacker to perform a Denial-of-Service attack by exhausting the server's available disk space through unlimited file uploads, potentially rendering the Langflow service and any co-hosted services unavailable. Additionally, the server's response discloses the absolute path of Langflow's cache directory, leaking filesystem structure information that could facilitate chaining with other vulnerabilities (e.g., path traversal or local file inclusion). The scope is marked as Changed in the CVSS scoring, reflecting that the disk exhaustion can impact resources beyond the Langflow application itself (GitHub Advisory).

A public proof-of-concept exploit is available in the official GitHub security advisory, consisting of a simple curl command requiring no authentication or prior knowledge. The NVD SSVC assessment classifies exploitation as automatable with a PoC status. The EPSS score is approximately 0.307–0.332%, indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Langflow instances (default port 7860) using tools like Shodan or Censys, or by directly probing known deployment URLs. Confirm the target is running a version prior to 1.9.1.
2. Identify the vulnerable endpoint: The deprecated but live endpoint is POST /api/v1/upload/{flow_id}. It does not appear in the Langflow API documentation (hidden via include_in_schema=False) but is reachable in production.
3. Craft the upload request: Use any valid UUID format as the flow_id path parameter (no real flow needs to exist). Send a multipart file upload request with no authentication headers:

   curl 'http://<target>:7860/api/v1/upload/11111111-1111-1111-1111-111111111111' -F "file=@/path/to/large_file"

4. Harvest the information leak: Parse the JSON response, which returns the absolute path of the uploaded file on the server:

   {"flowId":"11111111-1111-1111-1111-111111111111","file_path":"/Users/ori/Library/Caches/langflow/11111111-1111-1111-1111-111111111111/<sha256>.txt"}

5. Achieve DoS via space exhaustion: Automate repeated large file uploads in a loop to fill the server's disk, causing the Langflow service and potentially other co-hosted services to fail due to storage exhaustion (GitHub Advisory).

• Network: High volume of HTTP POST requests to /api/v1/upload/<uuid> from a single or rotating set of IP addresses, especially without authentication headers; large or repeated multipart form-data uploads to port 7860.
• File System: Rapid growth of the Langflow cache directory (typically ~/.cache/langflow/ or platform-equivalent); presence of many UUID-named subdirectories containing SHA-256-named files not associated with legitimate user flows; unexpected disk space exhaustion on the server hosting Langflow.
• Logs: Langflow access logs showing repeated POST /api/v1/upload/<uuid> requests returning HTTP 201 from unauthenticated sources; absence of Authorization or x-api-key headers in upload requests; multiple different UUIDs used as flow_id that do not correspond to existing flows (GitHub Advisory, Fix PR).

The primary remediation is to upgrade Langflow to version 1.9.1 or later, which fixes the vulnerability via PR #12831 by adding the get_flow dependency to the deprecated endpoint, requiring authenticated users with flow ownership before accepting uploads, and enforcing the max_file_size_upload limit (returning HTTP 413 for oversized uploads). Organizations unable to upgrade immediately should restrict network access to the Langflow instance (e.g., firewall rules blocking external access to port 7860), implement a reverse proxy with authentication in front of Langflow, and monitor disk usage for anomalous growth. Note that after upgrading, the Langflow SDK helper langflow.load.upload_file() requires an api_key parameter or the LANGFLOW_API_KEY environment variable to be set (GitHub Advisory, Fix PR).

The vulnerability was discovered by Ori Lahav, a security researcher at Rubrik Inc., and responsibly disclosed to the Langflow team. Security monitoring platforms including Tenable, Check Point, and Qualys have added detection coverage for this CVE. SecurityOnline.info published coverage of the Langflow security vulnerabilities. Social media activity was observed on Bluesky and Twitter/X (via CVEnew), indicating moderate community awareness. No major threat actor attribution or widespread alarm has been reported (Tenable, Check Point).