CVE-2025-3248: Langflow unauthenticated code injection in validate/code endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with CVSS 9.8, KEV listing with known ransomware use, and near-maximum EPSS make this an urgent patch-first issue.

What it is

Langflow versions prior to 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing code injection. A remote attacker can send crafted HTTP requests to execute arbitrary code on the server. This is a critical pre-auth RCE in an AI workflow tool, and it is being exploited in the wild.

Impact

An unauthenticated attacker gains remote code execution with the privileges of the Langflow service, leading to full compromise of the host and any data or credentials it can reach. CISA flags known ransomware campaign use, so impact can extend to lateral movement and data destruction.

Attack surface

Reachable over the network via HTTP requests to /api/v1/validate/code; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet-exposed or internally reachable Langflow instance below 1.3.0 is a target.

Exploitation

CISA added it to KEV on 2025-05-05 with known ransomware campaign use, and EPSS is 0.9999 (99.98th percentile). A public exploit write-up is referenced, so active exploitation is expected.

What to do

• Upgrade Langflow to 1.3.0 or later immediately; the patch is in PR #6911 and release 1.3.0.
• If upgrade is not possible, remove Langflow from network exposure and restrict access to the service to trusted management networks only.
• Follow CISA KEV required action: apply vendor mitigations, apply BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.
• Rotate any secrets, API keys, and credentials accessible to the Langflow service, and review the host for persistence after suspected exposure.
• Monitor for and block unauthenticated requests to /api/v1/validate/code at the reverse proxy or WAF.

Detection

• Search HTTP access logs for POST or other requests to /api/v1/validate/code, especially from unexpected or external source IPs.
• Look for anomalous child processes spawned by the Langflow service (python, sh, bash, curl, wget) indicating code execution.
• Monitor for outbound connections from Langflow hosts to unfamiliar destinations, consistent with post-exploitation or ransomware staging.
• Audit Langflow instances for version below 1.3.0 and alert on any that remain exposed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.