{
 "id": "AIR-2026-0731",
 "slug": "cve-2026-48519-langflow-unauthenticated-rce-in-playgrounds",
 "title": "CVE-2026-48519: Langflow unauthenticated RCE in playgrounds",
 "summary": "A critical remote code execution vulnerability in Langflow allows unauthenticated users to execute arbitrary Python code via shareable playgrounds. The flaw exists within public flow routing and custom node code execution.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow"
 ],
 "incident_date": "2026-06-16",
 "incident_date_precision": "day",
 "first_reported": "2026-06-16",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-v5ff-9q35-q26f",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-48519: Langflow: Unauthenticated RCE in Shareable Playgrounds",
   "published_at": "2026-06-16"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48519",
   "publisher": "NVD",
   "title": "CVE-2026-48519: Langflow is a tool for building and deploying AI-powered agents and workflows.",
   "published_at": "2026-06-23"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-48519",
  "rce",
  "langflow"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}