CVE-2025-3248: Langflow Unauthenticated RCE Remediation

Langflow versions before 1.3.0 expose a critical code-injection path in the /api/v1/validate/code endpoint. The vulnerable endpoint is reachable by a remote unauthenticated caller and can execute attacker-controlled Python code in the Langflow process context.

For Langflow deployments, the security boundary is not just package resolution. The endpoint exists to validate custom component code, so the mergeable fix must prove that validation requires the authenticated current user. Restricting the feature to a trusted component-author or administrator is additional defense-in-depth where the deployment has that role model; it is not the upstream CVE patch. Public ingress must not reach the route during rollout, and tests must not prove exposure by running exploit code. CISA added CVE-2025-3248 to the Known Exploited Vulnerabilities catalog, so exposed systems should also review logs and rotate reachable secrets after patching.

When to use it

• A repository deploys, builds, pins, vendors, or documents Langflow before 1.3.0.
• Langflow is exposed through reverse proxies, gateways, Kubernetes ingress, tunnels, devcontainers, shared workbenches, or hosted notebooks.
• Custom component authoring, playground, code-validation, or workflow editing features can reach /api/v1/validate/code.
• You need a bounded PR or triage note that upgrades Langflow and proves code validation requires authentication before execution sinks, with role-based authorization added as defense-in-depth where the product supports it.

Inputs

• Python dependency files, lockfiles, Dockerfiles, compose/Helm/K8s/Terraform manifests, gateway/proxy config, environment templates, SBOMs, deployment renders, and runbooks.
• Langflow version evidence, validation route ownership, auth dependencies, role model, ingress exposure, runtime isolation, logs, and credential rotation owners.
• Available dependency install, API auth tests, gateway policy tests, container build, deployment render, SBOM, and dependency/security scan commands.

Affected versions

• Vulnerable / NVD CPE: langflow last-affects below 1.3.0.
• Fixed / GHAD first_patched: langflow 1.3.0 and langflow-base 0.3.0.
• Fixed / NVD CPE: NVD excludes 1.3.0 on the langflow product only. 0.3.0 is not an NVD langflow exclude.
• Do not invent: flatten leftover 1.3.0 onto langflow-base, or invent a later 1.3.1 floor.
• Affected endpoint: POST /api/v1/validate/code
• Weaknesses: missing authentication for a critical function and improper control of code generation/execution.
• CISA KEV: yes; added 2025-05-05 with required action due 2025-05-26.

Indicator-of-exposure

• The repository deploys, builds, vendors, pins, or documents Langflow <1.3.0.
• A reverse proxy, load balancer, API gateway, Kubernetes ingress, Codespace, tunnel, shared workbench, or developer container exposes Langflow beyond a single trusted local user.
• Custom component authoring, code validation, playground, API, or workflow editing features are enabled.
• Public or unauthenticated traffic can reach /api/v1/validate/code or a wrapper route that forwards to it.
• The Langflow process can reach model provider keys, database credentials, flow secrets, package tokens, cloud metadata, mounted source code, internal services, or writable deployment storage.

Quick checks:

rg -n "langflow|LANGFLOW|/api/v1/validate/code|validate/code|validate_code|custom component|component code|playground|ingress|traefik|nginx|gateway" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"

Windows:

rg -n "langflow|LANGFLOW|/api/v1/validate/code|validate/code|validate_code|custom component|component code|playground|ingress|traefik|nginx|gateway" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"

Do not validate exposure by sending code payloads, running shell commands, reading files, printing environment variables, or touching real flows.

Remediation strategy

• Upgrade every controlled Langflow dependency, lockfile, image, Helm chart, compose service, deployment manifest, SBOM, and runbook to langflow 1.3.0+.
• Block unauthenticated access to /api/v1/validate/code at the application and gateway layers. If rollout is not atomic, temporarily deny the route at the edge until all runtimes are patched.
• Require the authenticated current user before accepting custom component code for validation. Where the deployment has a reviewed role model, also restrict that capability to a trusted component-author or administrator as defense-in-depth.
• Add regression tests that assert unauthenticated and low-privilege requests to the validation route fail before any code-validation or execution helper is invoked.
• Isolate Langflow with least privilege: remove cloud metadata reachability, avoid host mounts and Docker socket access, restrict egress, and keep secrets out of logs.
• Review application, gateway, process, and audit logs for unexpected validate/code traffic. Rotate Langflow, model provider, database, package, cloud, and workflow credentials when the endpoint was reachable by untrusted callers.

The prompt

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2025-3248, a critical Langflow unauthenticated code
injection vulnerability in the `/api/v1/validate/code` endpoint before
Langflow 1.3.0. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades Langflow, blocks
  unauthenticated validation access, adds safe regression coverage, refreshes
  generated artifacts, and documents operator cleanup, or
- TRIAGE.md if this repository does not own an affected Langflow runtime or
  cannot make a safe change.

## Rules

- Scope only CVE-2025-3248 and directly related Langflow code-validation,
  authentication, authorization, ingress, runtime isolation, and credential
  cleanup.
- Treat Langflow flows, component code, prompts, model provider keys, database
  credentials, package tokens, cloud credentials, source checkouts, uploaded
  files, internal URLs, and logs as sensitive.
- Do not prove exposure by executing code payloads, spawning shells, reading
  local files, dumping environment variables, beaconing to external services,
  or touching production flows.
- Do not leave `/api/v1/validate/code` reachable to unauthenticated users as a
  default path.
- Do not rely on UI hiding, prompt instructions, scanner suppression, or
  network location as the only security control.
- Do not auto-merge.

## Steps

1. Inventory every Langflow runtime controlled by this repository:
   `pyproject.toml`, `requirements*.txt`, lockfiles, Dockerfiles, compose
   files, Helm charts, Kubernetes manifests, Terraform, gateway/proxy config,
   environment templates, CI images, SBOMs, generated deployment output, and
   runbooks.
2. Determine every resolved Langflow version. A target is vulnerable if it
   resolves to `langflow <1.3.0` or an owned fork that exposes
   `/api/v1/validate/code` before authenticating the current user.
3. Search for code-validation and exposure surfaces:
   - `/api/v1/validate/code`, `validate_code`, custom component validation, and
     playground/API routes;
   - route dependencies that load the current user or enforce permissions;
   - reverse-proxy, ingress, tunnel, Codespace, devcontainer, and shared
     workbench access to Langflow;
   - logs or analytics that may capture component code or validation errors.
4. If this repository does not deploy or package Langflow, stop with
   `TRIAGE.md` listing files checked, runtime owner if known, observed version
   evidence, and required fixed version `langflow 1.3.0+`.
5. Upgrade every controlled Langflow package and image to `1.3.0+`.
   Regenerate lockfiles, image digests, SBOMs, deployment render output,
   dependency reports, and documentation as this repository normally does.
6. Add containment for non-atomic rollouts:
   - deny `/api/v1/validate/code` at the gateway or reverse proxy until patched;
   - restrict Langflow to authenticated networks or single-user loopback where
     applicable;
   - disable custom component/code-validation features for untrusted users;
   - fail closed if the Langflow version or auth state cannot be determined.
7. Where this repository controls Langflow product code or local patches,
   enforce authentication before code validation and, as defense-in-depth,
   authorization where a reviewed role model exists:
   - require a current authenticated user before parsing or validating supplied
     code;
   - when supported, require administrator or trusted component-author
     permission for custom component validation;
   - ensure denied requests return before validation helpers, imports, exec-like
     paths, subprocesses, or dynamic loading are reached;
   - keep component code, tracebacks, environment values, and secrets out of
     logs and HTTP responses.
8. Add safe regression tests:
   - missing authentication gets `401` or `403`;
   - a low-privilege authenticated user cannot validate custom component code;
   - the denied path does not call the validation/execution helper;
   - the intended trusted role still works without logging submitted code;
   - gateway/rendered deployment config denies public unauthenticated access
     during rollout;
   - dependency policy rejects `langflow <1.3.0`.
9. Harden runtime exposure where this repository controls deployment:
   - remove Docker socket and broad host mounts from Langflow containers;
   - run with a least-privilege service identity and read-only filesystem where
     practical;
   - block cloud metadata access and unnecessary outbound egress;
   - keep provider keys, database credentials, package tokens, and flow secrets
     out of environment snapshots, logs, and screenshots.
10. Add a PR body section named `CVE-2025-3248 operator actions` that states:
    - Langflow versions before and after;
    - whether `/api/v1/validate/code` was reachable beyond loopback or trusted
      networks;
    - whether unauthenticated callers could reach the route before the patch;
    - whether custom component/code-validation features are enabled and for
      which roles;
    - which logs were reviewed for validation-route traffic;
    - which Langflow, model provider, database, package, cloud, and workflow
      credentials should be rotated or why rotation is not required;
    - any temporary edge block that must remain until deployment completes.
11. Run relevant validation: dependency install, lockfile integrity, unit/API
    auth tests, gateway policy tests, container build, deployment render,
    SBOM refresh, dependency/security scans, and a non-exploit local smoke test
    that proves denial without executing submitted code.
12. Use PR title:
    `fix(sec): remediate CVE-2025-3248 in Langflow`.

## Stop conditions

- No affected Langflow runtime is controlled by this repository.
- Langflow is present only in prose or externally owned infrastructure; document
  owner, version evidence, exposure, and required fixed version in `TRIAGE.md`.
- A fixed Langflow version cannot be consumed without a broader migration and
  the repository cannot safely block the route at the edge.
- Product requirements intentionally expose unauthenticated code validation;
  document the risk and require a product/security decision.
- Meaningful verification would require executing attacker-controlled code,
  accessing production flows, or exposing secrets.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.

Rollback

Do not roll back into GHAD first_patched langflow below 1.3.0 or langflow-base below 0.3.0. Do not flatten leftover 1.3.0 onto langflow-base. If the patched release must be withdrawn, keep /api/v1/validate/code denied at the gateway or stop the public service until another fixed release is installed; roll back unrelated configuration separately.

Verification - what the reviewer looks for

• No controlled dependency, image, SBOM, deployment target, or runbook resolves Langflow <1.3.0.
• /api/v1/validate/code requires authentication before any code-validation helper, dynamic import, exec-like path, or subprocess sink is reachable.
• Where a reviewed role model is implemented, non-admin or untrusted users cannot validate custom component code unless that role explicitly owns the capability.
• Gateway or reverse-proxy containment is present when patched runtimes cannot roll out atomically.
• Tests prove denied requests do not execute submitted code and do not log component source or secrets.
• Operator notes cover KEV urgency, log review, credential rotation, and any temporary edge block.

Output contract

• Reviewer-ready PR upgrading Langflow to 1.3.0+ across dependencies, images, manifests, generated artifacts, SBOMs, and docs.
• Authentication is enforced before /api/v1/validate/code reaches validation, dynamic import, exec-like helpers, subprocesses, or code-loading sinks; role authorization is an additional control where locally supported.
• Safe regression tests proving unauthenticated and low-privilege requests are denied without executing submitted code or logging component source/secrets.
• TRIAGE.md when Langflow runtime, ingress, rollout, or credential cleanup ownership is outside this repository.

Watch for

• Updating one requirements.txt while a Docker image, Helm values file, compose service, CI image, or managed platform still runs an older Langflow.
• Fixing the browser UI while leaving the API route or an internal wrapper unauthenticated.
• Testing with live exploit payloads, production flows, real provider keys, or environment dumps.
• Logging submitted component code, tracebacks with secrets, or authorization bearer tokens while adding tests.
• Treating a private network as sufficient protection for shared developer workbenches, hosted notebooks, remote IDEs, or exposed preview deployments.
• Stopping at Langflow 1.3.0 after this CVE. Default deployments through 1.10.0 remain exposed to CVE-2026-9198 until 1.10.1.

Related recipes

• CVE-2026-55255 Langflow responses IDOR
• CVE-2026-9198 Langflow auto-login RCE
• Search the CVE Database for CVE-2025-12735
• Search the CVE Database for CVE-2026-5760
• CVE intelligence intake gate

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3248
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3248
• Langflow advisory: https://github.com/langflow-ai/langflow/security/advisories/GHSA-rvqx-wpfh-mfx7
• Langflow 1.3.0 release: https://github.com/langflow-ai/langflow/releases/tag/1.3.0
• Fix PR: https://github.com/langflow-ai/langflow/pull/6911
• CVE record: https://www.cve.org/CVERecord?id=CVE-2025-3248