Langflow CVE-2025-3248 unauthenticated RCE via validate/code endpoint

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•8

Detects unauthenticated attempts to exploit CVE-2025-3248 in the Langflow 'validate/code' endpoint, characterized by missing authentication headers and the presence of suspicious Base64-encoded payloads or command execution keywords. Additionally, it identifies potential post-exploitation activity where Langflow processes spawn Python subprocesses.