Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

The version of Langflow installed on the remote host is prior to 1.9.2. It is, therefore, affected by multiple vulnerabilities:

  - The Shareable Playground feature enables execution of workflows by unauthenticated users.
    When the route /api/v1/build_public_tmp executes a flow, it allows providing arbitrary     custom Python code as the nodes code inside the JSON payload, resulting in remote code     execution. (CVE-2026-48519)

  - By controlling files that are digested into the RAG, an attacker can direct components     based on BaseFileComponent to read any file on the filesystem by absolute path. Affected     components include Docling, Read File, NVIDIA Retriever Extraction, Video File, and     Unstructured API. (CVE-2026-55447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Langflow running on the remote host is prior to 1.9.2. It is, therefore, affected by a multiples vulnerabilities :

- An Unauthenticated RCE in Shareable Playgrounds

- An RCE through BaseFileComponent

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by
    controlling a files that are digested into the RAG, an attacker can direct the node to read any file on
    the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the
    vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent),
    Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File
    (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.
    (CVE-2026-55447)

ID	Name	Product	Family	Type	Severity
326243	Langflow < 1.9.2 Multiple Vulnerabilities	Nessus	Artificial Intelligence	Combined	critical
115275	Langflow < 1.9.2 Multiples Vulnerabilities	Web App Scanning	Artificial Intelligence	Version Based	critical
443680	SCA: security update for langflow (GHSA-ccv6-r384-xp75)	Tenable Cloud Security	SCA Checks	Local	critical
443680	SCA: security update for langflow (GHSA-ccv6-r384-xp75)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-55447

critical

Tenable Plugins

critical

critical

critical

critical