CVE-2026-55447: Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Synopsis

An arbitrary file read vulnerability with remote code execution potential affects Langflow, the AI agent and workflow builder, in all versions before 1.9.2. The flaw is reachable over the network without authentication, but requires a victim to interact with a malicious file fed into a Retrieval-Augmented Generation (RAG) pipeline; any component built on BaseFileComponent is affected, including Docling, Read File, NVIDIA Retriever Extraction, Video File, and Unstructured API nodes. Successful exploitation lets an attacker read any file on the host filesystem by absolute path and, in documented attack chains, pivot to remote code execution. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment version 1.9.2 or a later fix is confirmed upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Langflow service must be reachable over the network; an attacker submits a crafted file to a RAG pipeline endpoint exposed on the network.

• AuthenticationNot required

  No credentials or account are required to reach the affected endpoint and deliver a malicious payload.

• Victim interactionRequired

  A user or automated pipeline process must ingest the attacker-controlled file into a BaseFileComponent-based node, making this a social-engineering or supply-chain vector.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a malicious file is accepted; no race conditions or special memory layout are needed.

Blast Radius

• Reads arbitrary files from the host filesystem by absolute path, including secrets, credentials, environment files, and private keys accessible to the Langflow process.
• Modifies or exfiltrates data processed by downstream RAG pipeline components, corrupting AI agent outputs or leaking retrieved document contents.
• In documented exploit chains, achieves remote code execution on the host running the Langflow service.
• Disrupts availability of the Langflow service and connected agent workflows if the attacker chooses to crash or exhaust resources on the host.