Langflow flaw let anyone run code on exposed agent servers

A vulnerability in Langflow, a widely used visual builder for agent workflows, allowed unauthenticated attackers to execute arbitrary code on any exposed server. Tracked as CVE-2025-3248 and rated critical, it was patched in version 1.3.0 in late March 2025, added to CISA's Known Exploited Vulnerabilities catalog on 5 May, and later tied to a botnet campaign.

Horizon3.ai, which reported the bug, found that the endpoint Langflow used to validate user-written code passed that code to Python's exec function without requiring a login. Anyone who could reach the server over the network could therefore run commands as the Langflow process, which typically holds API keys for the models and tools the workflows use.

Because Langflow is often deployed on cloud instances to let teams build and share agents, many installations were reachable from the internet. Horizon3 said hundreds of exposed instances were visible in search engines at the time of disclosure.

In June 2025, Trend Micro reported that the Flodrix botnet was exploiting the flaw to install a denial-of-service payload on unpatched servers.

The Langflow maintainers added authentication to the endpoint in the fix. Researchers noted that the bug was not specific to AI: it was a classic missing authorisation check. But the surrounding context made it more damaging, since agent-building platforms concentrate credentials for many downstream services in one place.