CVE-2025-57760
BaseFortify
Publication date: 2025-08-25
Last updated on: 2025-09-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langflow | langflow | to 1.5.0 (exc) |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
| langflow | langflow | 1.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Langflow containers allows an authenticated user who already has remote code execution (RCE) access to escalate their privileges by using an internal CLI command called 'langflow superuser'. This command lets them create a new administrative user, granting full superuser access even if they initially registered as a regular, non-admin user.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized full superuser access within Langflow, allowing an attacker to gain complete control over the system. This can result in data breaches, unauthorized changes, disruption of services, and potential compromise of sensitive information.
What immediate steps should I take to mitigate this vulnerability?
Since a patched version is not yet publicly available, immediate mitigation steps include restricting authenticated user access to Langflow containers, especially limiting users with remote code execution (RCE) capabilities. Monitor and control usage of the internal CLI command 'langflow superuser' to prevent unauthorized creation of administrative users. Consider isolating or disabling the CLI access until a patch is released.