CVE-2026-55450

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.1

Description Unauthenticated users with network access can upload unlimited amounts of data to the server, which can lead to disk space exhaustion and a resulting denial-of-service. Additionally, the server response discloses the absolute path of the uploaded file, creating an information leak that could be used to facilitate further attacks. This issue occurs at the '/api/v1/upload/{flow id}' endpoint via the create upload file() function, where there is a lack of authentication and validation for the flow id variable. Over 38,300 potentially affected instances were identified via FOFA.

Recommendations Update to version 1.9.1. As a temporary workaround, restrict network access to the '/api/v1/upload/{flow id}' endpoint to minimize the risk of exploitation.