EXPOSURE Langflow
SEVERITY HIGH
PROBE GET :7860/api/v1/version
Is your Langflow exposed?
Flows and API keys behind it, with unauthenticated RCE in older versions.
Scan a host you own → Fix card Census
Why it matters
Your Langflow UI is reachable from the internet. Flows, stored credentials and model API keys sit behind it, and older versions have unauthenticated remote-code-execution vulnerabilities that bots exploit within hours of disclosure.
How common is it?
2,644 Langflow instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.title:"Langflow"` · 2026-08
Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.
Fix it
The full walkthrough lives on the fix card, kept current in one place: