8.8

CVE-2025-57760

Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation

Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Langflow ≫ Langflow Version < 1.5.0
Langflow ≫ Langflow Version 1.5.0 Update dev0
Langflow ≫ Langflow Version 1.5.0 Update dev1
Langflow ≫ Langflow Version 1.5.0 Update dev10
Langflow ≫ Langflow Version 1.5.0 Update dev11
Langflow ≫ Langflow Version 1.5.0 Update dev12
Langflow ≫ Langflow Version 1.5.0 Update dev13
Langflow ≫ Langflow Version 1.5.0 Update dev14
Langflow ≫ Langflow Version 1.5.0 Update dev15
Langflow ≫ Langflow Version 1.5.0 Update dev16
Langflow ≫ Langflow Version 1.5.0 Update dev17
Langflow ≫ Langflow Version 1.5.0 Update dev18
Langflow ≫ Langflow Version 1.5.0 Update dev19
Langflow ≫ Langflow Version 1.5.0 Update dev2
Langflow ≫ Langflow Version 1.5.0 Update dev20
Langflow ≫ Langflow Version 1.5.0 Update dev21
Langflow ≫ Langflow Version 1.5.0 Update dev22
Langflow ≫ Langflow Version 1.5.0 Update dev23
Langflow ≫ Langflow Version 1.5.0 Update dev24
Langflow ≫ Langflow Version 1.5.0 Update dev25
Langflow ≫ Langflow Version 1.5.0 Update dev26
Langflow ≫ Langflow Version 1.5.0 Update dev27
Langflow ≫ Langflow Version 1.5.0 Update dev28
Langflow ≫ Langflow Version 1.5.0 Update dev29
Langflow ≫ Langflow Version 1.5.0 Update dev3
Langflow ≫ Langflow Version 1.5.0 Update dev30
Langflow ≫ Langflow Version 1.5.0 Update dev31
Langflow ≫ Langflow Version 1.5.0 Update dev4
Langflow ≫ Langflow Version 1.5.0 Update dev5
Langflow ≫ Langflow Version 1.5.0 Update dev6
Langflow ≫ Langflow Version 1.5.0 Update dev7
Langflow ≫ Langflow Version 1.5.0 Update dev8
Langflow ≫ Langflow Version 1.5.0 Update dev9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.377
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r
Third Party Advisory
https://github.com/langflow-ai/langflow/commit/c188ec113c9ca46154ad01d0eded1754cc6bef97
Patch
http://github.com/langflow-ai/langflow/pull/9152
Patch