CVE-2026-55446

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
langflow-ai	langflow	< 1.0.19

References

https://github.com/langflow-ai/langflow/pull/3923Issue Tracking, Patch
https://github.com/langflow-ai/langflow/security/advisories/GHSA-qwqc-p3q8-wcg9Exploit, Patch, Vendor Advisory
https://github.com/langflow-ai/langflow/security/advisories/GHSA-qwqc-p3q8-wcg9Exploit, Patch, Vendor Advisory

Timeline

Published: Jun 23, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-554479.6Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into CVE-2026-554486.3mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from loc CVE-2026-554495.3CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without val CVE-2026-55456.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authentic CVE-2026-554509.3Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount o CVE-2026-554518.3gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits ne CVE-2026-554527.3Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsCo CVE-2026-554533.3OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quot CVE-2026-554549.9Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — wh CVE-2026-554559.1Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClie CVE-2026-554577.4The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration CVE-2026-554582.9Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/cad