CVE-2026-55450 is a critical-severity (CVSS 9.3) vulnerability in langflow. A fix is available for langflow — see the affected versions and patch details below.
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-55450.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2026-55450 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
langflowReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow.
This can lead to space exhaustion on the server.
In adition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives.
Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe
Details
Code is in langflow/api/v1/[endpoints.py](http://endpoints.py/):
@router.post(
"/upload/{flow_id}",
status_code=HTTPStatus.CREATED,
deprecated=True,
)
async def create_upload_file(
file: UploadFile,
flow_id: UUID,
) -> UploadFileResponse:
...
As can be seen above, there is no authentication. There is not validation over flow_id as well, unlike other endpoints:
flow_id_str = str(flow_id)
file_path = await asyncio.to_thread(save_uploaded_file, file, folder_name=flow_id_str)
Function save_uploaded_file saves the file to local file-system.
Suggested fix:
- Add authentication to route.
- Only return relative path or filename.
PoC
PoC:
curl 'http://localhost:7860/api/v1/upload/<any_uuid>' -F "file=@<any_file>"
Example:
# curl 'http://localhost:7860/api/v1/upload/11111111-1111-1111-1111-111111111111' -F "file=@/tmp/dummy.txt"
{"flowId":"11111111-1111-1111-1111-111111111111","file_path":"/Users/ori/Library/Caches/langflow/11111111-1111-1111-1111-111111111111/9d63c3b5b7623d1fa3dc7fd1547313b9546c6d0fbbb6773a420613b7a17995c8.txt"}
Impact
- Space exhaustion on server that can lead to Denial-of-Service.
- Information leak - leakage of absolute path of langflow's cache directory in server.
Patches
Fixed in 1.9.1 via PR #12831. The deprecated POST /api/v1/upload/{flow_id} endpoint now uses the get_flow dependency, requiring an authenticated user and flow ownership (returns 404 for missing or cross-user flows), and enforces the max_file_size_upload limit (HTTP 413) — closing the unauthenticated upload and disk-exhaustion vectors. Upgrade to 1.9.1 or later.
Note: the response still returns the file's absolute path (file_path); after this fix it is only disclosed to the authenticated owner of the flow.
Ori Lahav Security Researcher @ Rubrik Inc.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | langflow | all versions | 1.9.1pip install --upgrade 'langflow==1.9.1' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langflow, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update langflow to 1.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55450 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-55450 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-55450. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
How to detect CVE-2026-55450
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2026-55450 -u https://target- Template
- Langflow < 1.9.1 - Unauthenticated File Upload
- Severity
- critical
- Impact
- Unauthenticated attackers can exhaust server storage and gain information about file paths, potentially aiding further attacks.
- Remediation
- Update to version 1.9.1 or later.
Template by ProjectDiscovery nuclei-templates (xtr0nix), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2026-55450 in your dependencies?
O3 Security finds CVE-2026-55450 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.