Exploited vulnerability · CISA KEV

Is CVE-2025-3248 exploited? Yes: in CISA KEV since 5 May 2025

Gociux · Langflow · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2025-3248, Langflow Missing Authentication Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 5 May 2025, 28 days after it was published. It is known to be used in ransomware campaigns. It affects Langflow. If you run it, CISA's required action is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What it is

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.

What to do

1. Check whether you run it. Look for Langflow in your asset inventory, including appliances and cloud images. Stack check lists every exploited Langflow CVE at once.
2. Apply the fix. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 7 Apr 2025.
4. Get told next time. Email alerts when CISA adds a CVE for Langflow.

Other exploited CVEs in Langflow

• CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (21 Jul 2026)
• CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability (7 Jul 2026)
• CVE-2025-34291: Langflow Origin Validation Error Vulnerability (21 May 2026)
• CVE-2026-33017: Langflow Code Injection Vulnerability (25 Mar 2026)

References

• nvd.nist.gov/vuln/detail/CVE-2025-3248

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in May 2025 · Langflow scorecard · act-now radar.