CVE-2025-57760: Langflow Privilege Escalation Vulnerability

CVE-2025-57760 Overview

CVE-2025-57760 is a privilege escalation vulnerability in Langflow, an open-source platform for building and deploying AI-powered agents and workflows. The flaw resides in containerized deployments where an authenticated user who already has remote code execution (RCE) access can invoke the internal langflow superuser CLI command. Executing this command creates a new administrative account, granting full superuser privileges to a user who originally registered through the UI as a non-admin. The issue is tracked under CWE-269: Improper Privilege Management.

Critical Impact
An attacker with low-privilege authenticated access and the ability to execute code inside a Langflow container can escalate to a full administrative account, bypassing the UI-based role model.

Affected Products

Langflow 1.5.0 development releases (dev0 through dev31)
Langflow containerized deployments exposing the internal CLI
Langflow versions prior to the upstream fix in pull request #9152

Discovery Timeline

2025-08-25 - CVE-2025-57760 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57760

Vulnerability Analysis

Langflow ships a command-line interface used for administrative tasks, including the langflow superuser subcommand that provisions a new administrative account. In container deployments, this CLI remains reachable from the same execution context that hosts user-supplied flows and components. When an authenticated user obtains code execution inside the container, typically through Langflow's flow execution surface, the CLI becomes an in-process privilege escalation primitive.

The attacker does not need to compromise the underlying host or escape the container. Invoking the CLI from within the application context creates a new administrative user with credentials chosen by the attacker. That account can then log in through the standard UI and inherit superuser permissions over flows, components, secrets, and connected integrations.

Root Cause

The root cause is improper privilege management ([CWE-269]). The langflow superuser command performs administrative account creation without enforcing an authorization boundary against the calling identity inside the runtime container. Sensitive provisioning logic is co-located with user-reachable code execution surfaces, so any RCE inside the container inherits the ability to bootstrap a privileged user.

Attack Vector

Exploitation requires network access to a Langflow instance and a valid low-privilege account. The attacker first leverages an existing RCE primitive available to authenticated Langflow users, such as code-bearing components within a flow, to execute shell commands inside the container. They then invoke the langflow superuser CLI with attacker-controlled username and password values. After the command completes, the attacker authenticates to the Langflow UI with the new superuser credentials and assumes full administrative control of the environment.

No verified public proof-of-concept code is available for this issue. Refer to the GitHub Security Advisory GHSA-4gv9-mp8m-592r for upstream technical details.

Detection Methods for CVE-2025-57760

Indicators of Compromise

Unexpected superuser accounts in the Langflow user database that were not provisioned by administrators.
Process execution of langflow superuser or python -m langflow superuser originating from a Langflow container.
Shell or subprocess activity spawned by the Langflow application user that invokes the internal CLI.
New administrative logins from IP addresses or user agents previously associated with low-privilege accounts.

Detection Strategies

Monitor container process trees for child processes of the Langflow runtime that invoke the CLI binary or its Python module entry point.
Audit the Langflow user store for accounts with is_superuser=true and correlate creation timestamps against legitimate admin activity.
Alert on authentication events where a session transitions from a non-admin user to administrative API endpoints in a short window.

Monitoring Recommendations

Forward container exec and process telemetry to a centralized logging or SIEM pipeline for retention and correlation.
Track Langflow application logs for CLI invocations, user creation events, and role changes.
Baseline expected administrative account counts and alert on any deviation.

How to Mitigate CVE-2025-57760

Immediate Actions Required

Restrict network access to Langflow instances to trusted users and require strong authentication for all accounts.
Disable user self-registration where business requirements permit, reducing the pool of authenticated attackers.
Audit the Langflow user database immediately and remove any unrecognized superuser accounts.
Rotate credentials and API keys associated with the Langflow deployment and connected integrations.

Patch Information

At the time of CVE publication, a fixed public release had not been issued. The upstream remediation is tracked in Langflow pull request #9152 and committed in c188ec113c9ca46154ad01d0eded1754cc6bef97. Operators should monitor the GitHub Security Advisory GHSA-4gv9-mp8m-592r for the official fixed version and upgrade as soon as it is published.

Workarounds

Run Langflow containers with a non-root user and a read-only filesystem to limit the impact of in-container command execution.
Remove or restrict execute permissions on the langflow CLI binary inside production containers where administrative provisioning is not performed in-band.
Place Langflow behind an authenticating reverse proxy or VPN and disallow untrusted users from importing or executing arbitrary flow components.
Separate administrative provisioning from runtime containers by performing superuser creation in a dedicated, network-isolated management container.

bash

# Configuration example: drop CLI execute permission and run as non-root
# Apply inside the container image build (Dockerfile snippet)
RUN chmod 750 /usr/local/bin/langflow \
    && chown root:root /usr/local/bin/langflow
USER 1001:1001