CVE-2026-48520 json
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
published 4mo ago modified 16d ago also EUVD-2026-38520 , GHSA-rcjh-r59h-gq37 , PYSEC-2026-244
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.
Patch / fix
- pypi langflow 1.10.0
- langflow langflow 1.10.0
- langflow-ai langflow 1.10.0
Is CVE-2026-48520 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | langflow | <1.10.0 |
1.10.0 |
Affected products
- langflow-ai langflow
Classification
- Weakness
-
- CWE-73 External Control of File Name or Path
References
-
github.com
/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37
exploit, web, vendor-advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2026-48520
advisory
-
github.com
/langflow-ai/langflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2026-244.yaml
web
Sources
- CVE List CVE-2026-48520
- GitHub Advisory GHSA-rcjh-r59h-gq37
- NVD CVE-2026-48520
- OSV PYSEC-2026-244
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.