CVE-2025-57760: Langflow Privilege Escalation via CLI

# CVE-2025-57760: Langflow Privilege Escalation via CLI

https://gcdradar.vercel.app/incidents/cve-2025-57760-langflow-privilege-escalation-via-cli · AIR-2025-0328 · closed 2025-08-25

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-08-25
- AI role: Attack on AI
- Products: Langflow
- CVE ids: CVE-2025-57760
- CVSS: 8.8

## Summary

Langflow containers contain a privilege escalation vulnerability where authenticated users with remote code execution can invoke internal CLI commands to create superuser accounts. A vendor advisory was published to address the issue.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-08-25: CVE-2025-57760: Langflow is a tool for building and deploying AI-powered agents and workflows. (https://nvd.nist.gov/vuln/detail/CVE-2025-57760)
- 2025-08-25: CVE-2025-57760: Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) (https://github.com/advisories/GHSA-4gv9-mp8m-592r)

## Sources

- 2025-08-25 GitHub Advisory Database: CVE-2025-57760: Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) https://github.com/advisories/GHSA-4gv9-mp8m-592r
- 2025-08-25 NVD: CVE-2025-57760: Langflow is a tool for building and deploying AI-powered agents and workflows. https://nvd.nist.gov/vuln/detail/CVE-2025-57760

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.