CVE-2025-3248

Langflow's missing authentication flaw lets unauthenticated attackers execute arbitrary code via its code validation endpoint.

Langflow's /api/v1/validate/code endpoint lacks authentication, enabling remote attackers to execute arbitrary code without credentials. DIB orgs must ensure all AI/ML workflow tools enforce strict access controls and patch missing auth flaws immediately to prevent RCE and supply-chain compromise.

Shame score — A missing authentication flaw on a code validation endpoint is a negligent, avoidable design flaw that directly enables remote code execution and is actively exploited in the wild.