Langflow CVE-2025-3248: upgrade to 1.3.0 or take it off the internet
A missing login on a code-validation route in Langflow became a known-exploited bug in May 2025. The fix is version 1.3.0 or newer, plus a network boundary.
NVD describes CVE-2025-3248 as code injection in Langflow versions before 1.3.0. An unauthenticated remote caller could run code by sending a request to a validation route that did not require a login. The CVSS 3.1 score on the CVE record is 9.8.
CISA added it to the exploited catalog on 5 May 2025, with a federal due date of 26 May 2025. Singapore's Cyber Security Agency later described campaigns using the same bug to recruit hosts into denial-of-service botnets.
What was exposed
Langflow is a tool for building and deploying agents. The vulnerable function was a validation endpoint present, according to the finders at Horizon3.ai, back through years of releases. Version 1.3.0 put that endpoint behind authentication. The CVE record credits Naveen Sunkavally of Horizon3.ai.
Authentication on the route is the vendor fix. It does not make a Langflow superuser harmless: the product is designed so users can run flows on the server. The CVE is the case where a stranger, with no account, could do that.
What a public Langflow is
A host running a version before 1.3.0 and reachable from the internet was a remote code execution for anyone who asked. Researchers counted hundreds of exposed instances when the catalog entry landed. A demo on a laptop is a different risk from the same container with a public port.
Later reporting tied exploitation to botnet installation, not only to theft of the flows stored in the tool. The host's network position is the blast radius: cloud keys on the box, internal routes the box can open, and the agents' own tokens.
The version that closes the hole
Upgrade to Langflow 1.3.0 or any later release, from the project's own release, and restart the service so the old process is gone. Confirm the running version, not the image tag you meant to deploy.
If you cannot upgrade this week, remove the service from the internet. A firewall rule is a delay, not the fix CISA named. The catalog's required action is the vendor mitigation or discontinuing use.
After the upgrade
Treat any Langflow that was reachable and older than 1.3.0 as a host to investigate: new processes, new scheduled tasks, unexpected outbound traffic. Rotate tokens the process could read, including model-provider keys stored in the project.
Put the admin UI on a private network and require the login 1.3.0 added. Do not publish an agent builder because the demo was easier that way. This article does not include a request that triggers the bug.
NVD's record for CVE-2025-3248 and the CVE entry, which names versions before 1.3.0.
https://nvd.nist.gov/vuln/detail/CVE-2025-3248
Frequently asked questions
Which Langflow versions are affected?
The CVE record says versions before 1.3.0. The fix release is 1.3.0, which requires authentication on the validation route. Confirm the process you restarted, not only the file on disk.
Is a login enough if I stay on an old version?
No. The bug is that the route did not require a login. Adding a reverse-proxy password is a temporary barrier. The supported fix is 1.3.0 or newer.
When did CISA list it?
5 May 2025, with a US federal due date of 26 May 2025. It was already being used. Assume a public old instance needs a look at the host, not only a version bump.