2025-05 · 2025-Q2

Langflow CISA KEV Addition - Confirmed Active Exploitation

Primary layerL6 Identity / RunSecondary:L5 Config

Which agent, run, or tenant is this?
The question layer 6 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: Yes
Actor: Attacker

Target

Langflow (before v1.3.0)

Impact

Full server takeover; CISA confirmed active exploitation in the wild

Root cause

Code validation endpoint invokes exec() on user-supplied code without auth or sandboxing

CVE

CVE-2025-3248

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Langflow CISA KEV Addition - Confirmed Active Exploitation (2025-05). https://agentprov.com/incidents/2025-05-langflow-cisa-kev-addition-confirmed-active-exploitation

Same event · 2025-06Langflow Flodrix Botnet ExploitationL6Identity / Run
Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run