CISA's Known Exploited Vulnerabilities catalog (KEV) only lists a CVE when there is evidence that attackers are using it. In 2026, three products that sit in a lot of self-hosted AI stacks kept showing up there: the Langflow agent builder, the n8n workflow platform and the LiteLLM gateway. Counting the dates CISA added them, as recorded in NVD, that is nine KEV additions this year across the three.
None of these are exotic. They are code-execution and authentication bugs in admin surfaces that people put on the internet because the tool "needs a webhook" or "the team needs to reach it". Here is the list, the patterns, and what to run.
The 2026 KEV additions
| CVE | Product | What it is | Fixed in | Added to KEV |
|---|---|---|---|---|
| CVE-2026-33017 | Langflow | Unauthenticated code execution via /api/v1/build_public_tmp/{flow_id}/flow | 1.8.2 per NVD (advisory text: before 1.9.0) | 2026-03-25 |
| CVE-2025-68613 | n8n | Workflow expression evaluated outside a proper sandbox, code execution for authenticated users | 1.120.4, 1.121.1, 1.122.0 | 2026-03-11 |
| CVE-2026-42208 | LiteLLM | SQL injection in the proxy API key check, unauthenticated | 1.83.7 | 2026-05-08 |
| CVE-2025-34291 | Langflow | CORS * with credentials plus SameSite=None refresh cookie: token theft, then code execution | after 1.6.9 | 2026-05-21 |
| CVE-2026-42271 | LiteLLM | MCP "test connection" endpoints spawn the supplied command on the proxy host | 1.83.7 | 2026-06-08 |
| CVE-2026-55255 | Langflow | IDOR on /api/v1/responses: run another user's flow | 1.9.1 | 2026-07-07 |
| CVE-2026-0770 | Langflow | exec_globals on the validate endpoint, unauthenticated code execution as root (ZDI-26-036) | after 1.7.3 | 2026-07-21 |
| CVE-2026-9198 | Langflow | /api/v1/auto_login mints superuser tokens, chained with /api/v1/validate/code for full RCE | 1.10.1 | 2026-08-04 |
| CVE-2026-59822 | LiteLLM | Fabricated Authorization header falls back to an empty auth object on the MCP endpoint | 1.84.0 | 2026-09-02 |
Langflow also carries an older KEV entry, CVE-2025-3248 (code
injection in /api/v1/validate/code before 1.3.0, added in May 2025).
The 2026 entries show the same endpoint family coming back.
Pattern 1: an endpoint that runs the code you send it
Langflow's job is to run Python that users assemble into flows, so
exec() is part of the product. The KEV entries are the places where
that power was reachable by someone who should not have it:
- CVE-2026-33017: the public flow build endpoint accepted attacker-supplied flow data instead of the stored flow, and passed the node code to
exec()without authentication (NVD record, vendor advisory GHSA-vwmf-pq79-vjvx). - CVE-2026-0770: the
exec_globalsparameter of the validate endpoint let a remote, unauthenticated attacker run code as root, per the Zero Day Initiative advisory ZDI-26-036. - CVE-2026-9198: on default deployments,
/api/v1/auto_loginhanded a superuser token to any network caller, and/api/v1/validate/codethen executed whatever that caller sent (IBM's security bulletin).
n8n's CVE-2025-68613 is the same idea one step removed: expressions written during workflow configuration were evaluated in a context not isolated enough from the runtime, so an authenticated user could run code with the privileges of the n8n process (GHSA-v98v-ff95-f3cp).
Pattern 2: the gateway's own authentication
LiteLLM is an LLM gateway: it holds the provider keys and decides who may spend them. Two of its three KEV entries are failures of exactly that job.
- CVE-2026-42208: from 1.81.16 to before 1.83.7, the proxy built the API key lookup by mixing the caller's key into the SQL text. An unauthenticated
Authorizationheader on any LLM route could read, and possibly modify, the proxy database (GHSA-r75f-5x8p-qvmc). CISA added it the day NVD published it. - CVE-2026-59822: before 1.84.0, a fabricated header on the MCP Streamable HTTP endpoint triggered an OAuth2 passthrough fallback that replaced the failed key check with an empty auth object, so requests reached MCP tools without a valid key (GHSA-7488-6r32-c95q).
Langflow has the same class: CVE-2025-34291 combined a wildcard CORS
policy with credentials and a SameSite=None refresh cookie, so any web
page a logged-in user visited could mint fresh tokens for them, and
CVE-2026-55255 let one authenticated user run another user's flow by
guessing its ID.
Pattern 3: "test connection" buttons
CVE-2026-42271 is worth reading in full. LiteLLM's endpoints for previewing an MCP server before saving it accepted a complete stdio server configuration, including the command and its arguments, and started it as a subprocess on the proxy host (GHSA-v4p8-mg3p-g94g). Any feature that "tries" a configuration before you save it executes that configuration. If the endpoint is reachable by more people than the ones allowed to change the server's config, it is a remote shell.
What to run and what to lock down
- Langflow: 1.10.1 is the minimum that clears every KEV entry above according to NVD's version data. Later releases also fix CVE-2026-9081, an SSRF through the Ollama provider key check that NVD lists as fixed in 1.11.0, so take the current release. Turn off auto-login on anything reachable from another machine.
- n8n: 1.120.4, 1.121.1 or 1.122.0 depending on your branch, or anything newer.
- LiteLLM: 1.84.0 or newer clears all three KEV entries.
- Put all three behind authentication you control (an identity-aware proxy, a VPN such as Tailscale or WireGuard, or at minimum HTTP basic auth at the reverse proxy). Their own login screens are the thing these CVEs keep bypassing.
- If one of them was internet-facing on an affected version, assume it ran attacker code: rotate every provider key and secret the process could read, and rebuild the host.
Keep watching
The live lists for each product are on PocketClaw, refreshed from NVD
every six hours with KEV flags: Langflow CVEs,
n8n CVEs, LiteLLM CVEs. To see which of
them hit the versions you actually run, paste your
docker-compose.yml or requirements.txt into the
stack scanner. The preview is free and needs no account.