CISA updated its Known Exploited Vulnerabilities catalog on July 7, 2026, and the important change for hosting teams is not a new CVE count. It is the ransomware status on CVE-2025-3248.
The catalog entry for CVE-2025-3248, a Langflow missing authentication vulnerability, now lists known ransomware campaign use. That is a different operational signal than a routine historical CVE listing. If you run Langflow for AI workflow building, internal automation, customer demos, lab tooling, or hosted application development, treat this as a same-day exposure check.
Langflow is a low-code tool for building AI workflows. That makes internet-exposed instances attractive because they often sit near credentials, model providers, data stores, webhooks, and automation runners. The safe response is not to study public attack writeups. The safe response is to prove where Langflow exists, confirm version state, restrict access, rotate sensitive integrations where exposure is uncertain, and remove any unmanaged public instance.
What Changed
CISA’s catalog still lists 1631 entries in this pass, so this was not a new KEV addition. The change was inside the existing Langflow entry: CVE-2025-3248 moved from ransomware campaign use marked unknown to Known in catalog version 2026.07.07.
The CVE record and NVD entry describe the issue as affecting Langflow versions before 1.3.0. GitHub’s advisory page for the referenced advisory also points to 1.3.0 as the patched version, while noting that advisory record was later withdrawn as a duplicate and preserved for reference. For admin triage, the practical version line remains clear: exposed Langflow below 1.3.0 should not remain in service.
Who Should Check
Check this immediately if any of the following apply:
- You have used Langflow in a public demo, internal AI builder, proofing server, or customer-facing sandbox.
- You deploy AI workflow tools through Docker, Python package installs, cloud templates, developer VPS instances, or temporary lab servers.
- You host application builders for customers and do not have a current inventory of exposed admin or builder panels.
- You previously patched the newer Langflow CVE-2026-33017 issue but did not separately audit older Langflow installations.
Defensive Checklist
- Find every Langflow instance. Check production, staging, lab, developer, and customer demo environments. Do not assume a tool is gone because the project ended.
- Confirm version state. Treat versions before 1.3.0 as unsafe for internet exposure and prioritize upgrade, isolation, or removal.
- Remove public access first. Put Langflow behind VPN, SSO, firewall allowlisting, or a private network boundary while you verify version and configuration.
- Review integrations. Look for model provider keys, database credentials, webhook secrets, storage tokens, and automation credentials that may have been reachable from the Langflow environment.
- Rotate where exposure is uncertain. If an affected instance was public and you cannot prove clean history, rotate connected secrets and review downstream logs.
- Check persistence and jobs. Review scheduled jobs, containers, startup services, unfamiliar processes, and unexpected outbound connections on hosts that ran exposed Langflow.
- Document the exception state. If a customer or internal team cannot upgrade immediately, record the compensating controls, owner, and removal date.
Hosting And MSP Notes
For hosting providers, this belongs in the same bucket as exposed admin panels, build tools, notebook servers, and temporary developer utilities. The risky pattern is not only the vulnerability. It is the unmanaged AI builder left reachable after a project moves on.
If you support customers with VPS or app-hosting environments, search support notes and deployment templates for Langflow. Customers may not describe it as a security-sensitive service. They may call it an AI builder, agent builder, workflow test box, automation UI, or demo app. Use service inventory, container names, process names, package manifests, and reverse proxy configs to find it.
Bottom Line
CVE-2025-3248 is no longer just an older Langflow KEV entry to assume was handled in May 2025. CISA’s ransomware-use status change means exposed Langflow should be treated as an active operational risk until version, access control, and connected secrets are verified.
Patch or remove affected Langflow installs, keep builder tools off the public internet, and review any connected credentials if exposure history is unclear.
Sources: CISA Known Exploited Vulnerabilities catalog, CVE.org, NVD, GitHub Advisory Database, and Langflow release references. Exploit mechanics and route details are intentionally omitted.