CVE-2025-57760
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-08-25
Last updated on: 2025-09-03
Assigner: GitHub, Inc.
Description
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langflow | langflow | to 1.5.0 (exc) |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
