CVE-2025-3248: Langflow Missing Authentication Vulnerability

Vulnerability summary

CVE-2025-3248 is a critical (CVSS 9.8) vulnerability in Langflow. It is known to be exploited: CISA lists it, first on 05-05-2025. It has been used in ransomware campaigns. EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 07-04-2025
   PublishedVulnerability first disclosed.
2. 05-05-2025
   Added to CISA KEVLangflow Missing Authentication Vulnerability
3. 26-05-2025
   CISA remediation dueApply mitigations per vendor instructions.
4. 08-10-2026
   Last modifiedVulnerability information updated.

Description

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.