Loading today’s stories
Security1 distinct publisher2 min readPublished
CVE-2026-48519 lets anyone holding a shared Langflow playground link supply their own Python inside the build request. The exposure follows a user clicking share, so it lives in flow state rather than in server config.
The Watch · Security desk
science
OX Security says MCP command execution is a design choice, so server owners own the risk1 distinct publisher
build
Fabricated SQLite CVEs cleared NVD, CISA ADP and Red Hat before anyone ran the code1 distinct publisher
build
GitLab bundles a zero-click GraphQL flaw with a CSRF bug, and only one needs a victim1 distinct publisher
security
CDN Tsunami: the protocol translation you pay for is the amplifier1 distinct publisher
Compiled by The WatchSomething wrong?How this is made
The stack trace published with the advisory follows the request body all the way into the interpreter. `generate_flow_events` calls `build_graph_and_get_order`, then `create_graph`, then `build_graph_from_data`; `Graph.from_payload` builds vertices from the submitted data, `add_nodes_and_edges` calls `initialize`, and `instantiate_component` ends in `instantiate_class`, whose final frame is `<string>`, line 59, in `__init__` [12]. The component code string is compiled and run while the graph is being assembled. The flow does not have to do anything useful for that to happen, which is why the reproduction gets by with a single Chat Input node [9]. The sample payload runs `touch /tmp/pwned` [17].
The request in the proof of concept carries a `Content-Type` header, a cookie reading `client_id=anything`, and the raw JSON body [10]. There is no session cookie in it and no bearer token either. That is worth stating because the advisory contradicts itself on this exact point: the summary attributes the risk to authenticated users, while the details section and the impact statement both describe unauthenticated execution [8][2][7]. The published request supports the impact statement. What an attacker needs is the public flow ID in the URL [16].
The reproduction runs to five steps. The division of labour among them is the finding. The deployment's own user performs the first two by creating a flow and sharing it. The remaining three need only the resulting link [15]. An admin who has hardened the install and pinned the version still inherits the exposure the moment a colleague shares a playground.
The published request also sets `log_builds=false` in the query string [11]. That is a client-controlled parameter on a route unauthenticated callers reach [3], so build logs are a poor first place to look. The path itself, `/api/v1/build_public_tmp`, is the durable indicator [3].
Scope reduces to two things an operator can establish without waiting on a release: whether that route is reachable from outside the network, and how many flows are currently marked public [2]. Rubrik's Ori Lahav tested against commit `2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe` [13][6], and the advisory text offers no fixed version, patch commit, or CVSS score to compare against [14]. The feature executes workflows for people without accounts, and that is what it was built to do. The defect is that the workflow definition arrives in the same request [4][5].
Ranked by verification strength, evidence, and original report placement.
A GitHub Advisory Database entry, tracked as CVE-2026-48519, describes a critical remote code execution vulnerability in Langflow's "Shareable Playground" feature, referred to as "Public Flows" in the code.
The Shareable Playground feature works by enabling the execution of workflows by unauthenticated users who access a link.
The feature enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID.
When the route executes the flow, it allows arbitrary custom Python code to be provided as the nodes code inside the JSON payload.
The vulnerable field is data.nodes[X].data.node.template.code.value.
The issue was tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe.
Distinct publishers with included, body-backed reporting in this cluster.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Reproducible down to the JSON path
This is the strong kind of single-source: the advisory does not assert a vulnerability, it hands you the request that demonstrates one — route, field path, cURL, query string, and a stack trace that ends in dynamically compiled code inside component instantiation. Two things hold the score below the top band: nobody outside the write-up has reproduced it in our coverage, and the entry pins itself to one tested commit rather than a version range, so the boundary of what is affected is unestablished.
No deployment signal
Our coverage says how the bug works and nothing about how many Langflow installations have ever had a flow shared. There is no telemetry, no scan count, no exploitation report, and no patched release whose uptake could be tracked — so any number here would be invented.
The advisory undersells its own finding
Most security write-ups lean the other way. This one leads with "RCE risk by authenticated users" and then publishes a request whose only cookie is client_id=anything, which is the opposite of a credential. The framing is quieter than the artifact it ships, and the absence of a CVSS score means the loudest number in the entry is the word "critical". Slightly understated rather than aligned.
Vendor byline, checkable claim
The finder is a researcher at Rubrik and the write-up signs off with that affiliation, which is a reputational return on disclosure. It stays a weak lever: the venue is GitHub's advisory database rather than a vendor blog, nothing in the text pitches a product, and the claims that matter are all stated in a form a reader can run for themselves. Pulling the other way, the party with the strongest interest in how scope and severity are framed — whoever maintains Langflow — never speaks in our coverage.
Precise, dated, and unreviewed
We are confident about the mechanism and much less so about its perimeter. One publisher, one researcher, a firm publication date, and artifacts specific enough to be checked — but no maintainer confirmation, no fixed version to bound the affected population, and an internal contradiction over whether authentication matters that no second account can settle.