CVE-2026-6596

BRIEFING NOTE - CVE-2026-6596 A critical file upload vulnerability exists in Langflow-AI's Langflow application up to version 1.1.0, specifically in the create_upload_file function within the API endpoint component. This flaw permits unrestricted file uploads to affected systems, allowing attackers to bypass intended access controls on the upload mechanism. The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH), with a network-based attack vector requiring no special privileges or user interaction. The attack complexity is low, making exploitation straightforward. Successful exploitation could result in partial compromise of confidentiality, integrity, and availability across the affected system. The vulnerability is currently active on threat tracking lists and poses an elevated risk for exploitation. Public exploit code has been released, increasing the immediate threat to unpatched installations. Despite early vendor notification, the development team has not provided a response or patch, leaving users without an official remediation path. Organizations running Langflow 1.1.0 and earlier should treat this as a priority security concern and implement compensating controls or consider upgrading once patches become available.