Dashboard / CVE-2026-55450

CVE-2026-55450

CRITICAL
INFO Priority: 0.11 BB Relevance: 79/100
Published: 2026-06-23 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Changed
C: Low
I: None
A: High

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.

Weakness Classification (3)

Affected Software (1)

VendorProductVersion
langflow langflow < 1.9.1

References & Advisories (2)

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H

EPSS — Exploitation Probability

1.19%
Raw Score 0.011900
Percentile 67.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.01190
2026-10-28
0.01190

Intelligence Sources

nvd ref →

External Links