Quick links
Press Enter to search, Esc to close
Exploited vulnerability
CVE-2025-3248 is a flaw in Langflow, an open-source tool for building AI workflows.
In short
CVE-2025-3248 is a flaw in Langflow, an open-source tool for building AI workflows. One web endpoint accepts code from anyone without a login and runs it, so an attacker can take over the server. CISA lists it as exploited and flags known ransomware campaign use. Versions before 1.3.0 are affected.
A remote attacker with no account can send crafted HTTP requests to the /api/v1/validate/code endpoint and make the server run arbitrary code. NVD scores it 9.8 on CVSS v3.1 (the same score comes from the VulnCheck record). AI workflow servers often hold API keys and data connections, so a takeover can expose those secrets.
Per the vendor's GitHub advisory and NVD, Langflow versions before 1.3.0. The advisory also lists the langflow-base package before 0.3.0. The fixed release is 1.3.0 for the langflow package. Any Langflow server reachable from the internet or from untrusted networks on an old version is exposed.
NVD published the record on 7 April 2025. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) catalog on 5 May 2025 and flags known use in ransomware campaigns. The vendor's GitHub security advisory carries a publication date of 17 June 2025.
The sources opened here give no first-exploitation date and do not name which actors used the flaw, so no actor is attributed on this page. Treat any Langflow server that was exposed on a version before 1.3.0 as possibly compromised.
Move to 1.3.0 or later, the first patched release named in the vendor advisory. Also update langflow-base to 0.3.0 or later where it is installed separately.
Put Langflow behind a VPN or an authenticating proxy. It should not accept anonymous traffic from the internet.
If an old version was reachable, replace the API keys, database passwords and tokens stored in or reachable from the server.
Search web logs for requests to /api/v1/validate/code from unknown addresses, and check the host for new processes started by the Langflow service, new accounts, scheduled tasks and unexpected outbound connections.
CVE-2025-3248 is a missing-authentication flaw in Langflow, an open-source AI workflow builder. A remote attacker with no account can send crafted requests to the /api/v1/validate/code endpoint and make the server run arbitrary code. NVD scores it 9.8.
Langflow versions before 1.3.0 are affected, and the advisory also lists langflow-base before 0.3.0. The fixed release is 1.3.0 for the langflow package. Any old version reachable from the internet or untrusted networks is exposed.
Yes. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on 5 May 2025 and flags known use in ransomware campaigns. The sources used on this page do not name which actors exploited it.
Upgrade to Langflow 1.3.0 or later and keep the server behind a VPN or an authenticating proxy. If an old version was reachable, rotate the API keys, database passwords and tokens stored on it, and search logs for requests to /api/v1/validate/code.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.