unauth

← fix library

CRITICAL Langflow: Langflow CVE-2025-3248 — unauthenticated RCE

Why it matters

Your Langflow version lets anyone on the internet execute Python code on your server with no login at all, through a public API endpoint. Actively exploited. This is a full server compromise, not a data leak.

Fix it — 3 steps

  1. Upgrade to Langflow 1.3.0 or later immediately. Every version before that is exploitable.
  2. Until upgraded, take it off the internet: `sudo ufw deny 7860` or bind to localhost.
  3. Check for compromise if you ran a vulnerable version exposed: unknown processes, unexpected outbound connections, new files outside the Langflow dirs.

Verify it’s fixed

curl -s http://YOUR_SERVER_IP:7860/api/v1/version  # must be >= 1.3.0

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack