3 articles tagged
CVE-2026-9198 chains two Langflow API endpoints into unauthenticated remote code execution on default deployments. IBM rates it CVSS 9.8, CISA calls it exploited, and the fix is a version bump plus three configuration
JADEPUFFER exploited a critical Langflow flaw (CVE-2025-3248) and used an LLM to chain reconnaissance, theft and database extortion with no human operator. A breakdown of the attack and a 2026 defense checklist
CVE-2025-3248 gave unauthenticated attackers code execution on Langflow, and it was not the last. How to harden Langflow, Flowise, and n8n: patching, network isolation, gateway auth, secrets, and sandboxing for AI
