← fix library

FIX CARD
PRODUCT Langflow
SEVERITY CRITICAL

CRITICAL

Langflow CVE-2025-3248 — unauthenticated RCE

Why it matters

Your Langflow version lets anyone on the internet execute Python code on your server with no login at all, through a public API endpoint. Actively exploited. This is a full server compromise, not a data leak.

Fix it: 3 steps

  1. Upgrade to Langflow 1.3.0 or later immediately. Every version before that is exploitable.
  2. Until upgraded, take it off the internet: sudo ufw deny 7860 or bind to localhost.
  3. Check for compromise if you ran a vulnerable version exposed: unknown processes, unexpected outbound connections, new files outside the Langflow dirs.

Verify it’s fixed

curl -s http://YOUR_SERVER_IP:7860/api/v1/version  # must be >= 1.3.0

References

CVE mapping behind this card: human-verified, last checked 2026-07-29.

Not sure if your stack is exposed?

Run the free check: usually under a minute, safe read-only probes.

Scan your stack