CVE-2026-55450: Langflow Denial of Service Vulnerability

CVE-2026-55450 Overview

CVE-2026-55450 affects Langflow, an open-source tool for building and deploying AI-powered agents and workflows. Versions prior to 1.9.1 allow unauthenticated users to upload arbitrary amounts of data to the server without size or rate limits. The endpoint also returns the absolute file path of each uploaded artifact in its response. Attackers need only network access to the Langflow instance to exploit this flaw. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is fixed in Langflow 1.9.1.

Critical Impact
Unauthenticated attackers can exhaust server storage and harvest absolute filesystem paths, enabling denial of service and chaining into further attacks against Langflow deployments.

Affected Products

Langflow versions prior to 1.9.1
Self-hosted Langflow deployments exposed to untrusted networks
Containerized Langflow instances running vulnerable releases

Discovery Timeline

2026-06-23 - CVE-2026-55450 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-55450

Vulnerability Analysis

The vulnerability resides in the Langflow file upload handler, which accepts uploads without authentication, authorization, or quota enforcement. Any client able to reach the Langflow HTTP service can submit unlimited file content. The server writes each payload to disk and responds with the absolute path of the stored file. This combination produces two distinct primitives in a single request flow: uncontrolled resource consumption and information disclosure of internal filesystem layout. The information disclosure component is the basis for the CWE-200 classification, while the storage exhaustion behavior turns the same endpoint into a denial-of-service primitive.

Root Cause

The root cause is missing pre-upload controls on a public endpoint. The handler does not require authentication, does not validate request size, does not enforce per-client or global storage quotas, and does not sanitize response data. Returning the absolute path leaks deployment details such as container layout, mount points, and user home directories.

Attack Vector

An attacker reaches the Langflow service over the network and issues repeated multipart upload requests of large or numerous files. The server consumes disk space until the volume hosting Langflow data is exhausted, degrading or stopping the service. Each response discloses the absolute path of the stored file, which the attacker can use to plan path traversal, local file inclusion, or post-exploitation steps against other primitives in the application. No credentials, user interaction, or prior knowledge of the deployment are required. See the GitHub Security Advisory GHSA-x223-p2gf-v735 and the upstream fix in pull request #12831 for technical details.

Detection Methods for CVE-2026-55450

Indicators of Compromise

Sudden growth of the Langflow upload directory or backing volume usage
High volume of unauthenticated POST requests to Langflow file upload endpoints
Repeated upload requests originating from a single IP or small set of IPs
Application logs showing large or unusually sized multipart uploads prior to 1.9.1

Detection Strategies

Monitor HTTP access logs for unauthenticated upload requests against Langflow routes
Alert on filesystem usage thresholds on volumes that store Langflow uploads
Correlate spikes in 2xx upload responses with absent session or token headers
Inspect response bodies in proxy logs for absolute filesystem paths leaving the service

Monitoring Recommendations

Forward Langflow application and reverse proxy logs to a central analytics platform
Track per-source-IP request rates and cumulative upload byte counts
Set disk utilization alarms at 70 percent, 85 percent, and 95 percent on Langflow storage
Review egress responses for paths matching internal directory patterns such as /app/, /home/, or container mount points

How to Mitigate CVE-2026-55450

Immediate Actions Required

Upgrade Langflow to version 1.9.1 or later on all deployments
Restrict network exposure of Langflow to trusted users using a VPN, allowlist, or reverse proxy authentication
Enforce authentication in front of Langflow until the upgrade is verified
Rotate any secrets whose paths may have been disclosed through previous upload responses

Patch Information

The maintainers fixed CVE-2026-55450 in Langflow 1.9.1. The corrective changes are tracked in pull request #12831 and described in the GHSA-x223-p2gf-v735 advisory. Operators should pin container images and Python package versions to 1.9.1 or later and confirm the upgrade in staging before production rollout.

Workarounds

Place Langflow behind a reverse proxy that enforces authentication and a maximum request body size
Apply per-client rate limits and connection caps at the proxy or web application firewall layer
Mount the Langflow upload directory on a dedicated volume with a hard quota to contain exhaustion
Strip or rewrite response fields that contain absolute filesystem paths at the proxy layer

bash

# Example NGINX reverse proxy controls in front of Langflow
client_max_body_size 10m;
limit_req_zone $binary_remote_addr zone=langflow_up:10m rate=5r/m;

location /api/v1/files/upload {
    limit_req zone=langflow_up burst=5 nodelay;
    auth_request /_auth;
    proxy_pass http://langflow_backend;
}