Tag archive
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
Stop switching tabs between your IDE and Langflow. Learn how to use the Langflow MCP to execute, manage, and transform visual workflows into actionable agentic intelligence directly within Claude or Cursor.
Originally published at norvik.tech Introduction Deep dive into the first fully...
Learn how to create and deploy AI-powered agents using cutting-edge open-source tools like Langflow, PyTorch, and TensorFlow, and start automating tasks today.
This article details a cryptocurrency-mining campaign exploiting CVE-2026-33017, an unauthenticated...
Langflow Security Hardening 2026: Patch CVE-2026-5027
Originally published at norvik.tech Introduction A deep dive into the vulnerabilities...
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
The JADEPUFFER campaign exploited a 9.8 CVSS flaw in Langflow to automate ransomware with AI agents. Reconnaissance, lateral movement, and encryption of 1,342 Nacos configs—no human needed. This marks a shift from hypothetical to operational agentic threats.
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Attackers are actively targeting AI development infrastructure, and Langflow CVE-2026-5027 is the...
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.