CVE Intelligence
Analysis AI-assisted

CVE-2026-48519: Langflow Code Injection in Shareable Playground (Critical RCE)

Langflow versions before 1.9.2 contain a critical code injection flaw in the Shareable Playground feature, which lets unauthenticated users run public flows through a link. The CNA record assigns a CVSS 3.1 base score of 9.6 and states the issue is fixed in 1.9.2. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Langflow is a platform for building and deploying AI agents and workflows. According to the GitHub Security Advisory, versions before 1.9.2 contain a critical flaw in the Shareable Playground feature, also called Public Flows in the code. The flaw allows public flows to be executed through a link, and it is classified as CWE-94 (Code Injection).

Impact

  • The advisory describes remote code execution: a remote party can supply arbitrary Python code as part of a request to a public execution route.
  • The CVSS 3.1 base score supplied by the CNA is 9.6 (critical), with high confidentiality, integrity and availability impact and a changed scope.
  • Code running on the Langflow server would act within that server's context, so real consequences depend on the deployment. The sources do not detail them.

Affected products and versions

  • Product: Langflow (Langflow Langflow).
  • Affected: versions before 1.9.2.
  • Fixed: version 1.9.2, according to the record description. The structured fixes list in the record is empty, so the advisory should be checked to confirm the patched release.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the data consulted. No confirmed exploitation in the wild appears in the sources consulted. The reference list tags the advisory as Exploit, but the record does not describe any observed attacks.

Remediation and mitigation

  • Upgrade Langflow to version 1.9.2 or later.
  • Until the upgrade is complete, check whether Shareable Playground or public flows are enabled, and disable public sharing for flows that do not need it.
  • Restrict network exposure of Langflow instances and avoid exposing public flow execution to untrusted parties without compensating controls.
  • If a vulnerable version was reachable from the internet, review and rotate credentials and secrets available to the Langflow process.

Detection guidance

  • Review web server and application logs for unauthenticated requests to the public build route and for unusual POST activity against public flow endpoints.
  • Monitor the Langflow process for unexpected child processes, outbound connections or file changes, which can indicate code execution.
  • Audit which flows are marked as public and confirm that each one is intended to be public.

Limitations of the available information

  • The record gives a single affected range and does not state whether fixes exist for other release branches.
  • The CVSS vector includes user interaction (UI:R), while the description refers to access through a link. The sources do not explain this difference.
  • The record contains no EPSS score, SSVC data or independent proof-of-concept analysis.
  • Whether any specific deployment was compromised cannot be determined from these sources.

Frequently asked questions

Which Langflow versions are affected by CVE-2026-48519?

The record lists Langflow versions before 1.9.2 as affected. The description states the issue is fixed in 1.9.2.

Is this vulnerability being exploited in the wild?

The CVE is not listed in the CISA KEV catalog in the data consulted, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.