What it is
CVE-2024-37014 is an unauthenticated vulnerability affecting Langflow-ai Langflow. Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint...
Vulnerability report
Active exploitation observed
Confirmed confidence
Not in CISA KEV
CVE-2024-37014
Langflow Remote Code Execution
Langflow-ai / Langflow · 0 to <= 0.6.19
- Severity
- CVSS 9.8 · Critical
- Confidence
- Confirmed
- Exploit status
- Observed in sensors
- EPSS
- 63.7%
- First observed
- 13 Jul 2026
- Last observed
- 07 Oct 2026
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Is it exploited?
Yes. Previdian sensors observed exploitation attempts with confirmed confidence.
Who is affected?
Langflow-ai / Langflow 0 to <= 0.6.19.
What should we do?
Patch immediately, validate internet-facing exposure, and monitor for matching requests.
Overview
Langflow Remote Code Execution
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
Vendor
Product
Affected
Status
langflow
Affected
langflow
Through 0.6.19
Affected
- Published
- 10 Jun 2024
- Exploitation Reported
- 13 Jul 2026
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
Tags
python
nuclei_scanner
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2024-37014
- GitHub — langflow-ai/langflow github.com · CVE Record https://github.com/langflow-ai/langflow/issues/1973
Exploitation evidence
Why Previdian marks this CVE as exploited
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploited in the wild
Previdian
Previdian independently recorded this as exploited after first seeing it in honeypot sensors.
Active exploitation observed
Previdian sensor
Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.
Proof of concept available
Nuclei Templates
Public scanner or PoC coverage increases practical exploitability.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| Previdian Sensors First | 2026-08-01 10:55 UTC |
Operational indicators for this CVE are listed under Detection.
Sensor telemetry
First-party evidence of exploitation activity
Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.
990
Attempts observed
59
Unique attacker IPs
19
Attacker countries
BR · CN · DE · DK · FR · GB · HK · ID · JP · KH · KR · MY · NL · PK · SA · SG · TR · UA · US
3
Sensors observed
CVE-2024-37014 exploitation attempts over the last 91 days
Daily events observed by Previdian sensors
Updated 11 Oct 2026
13 Jul
1 Aug
20 Aug
8 Sep
11 Oct
First observed 13 Jul 2026 · Last observed 07 Oct 2026
Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 3
- 20
- 4
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
Nuclei template detected 05 Aug 2026.
View Nuclei template (opens in new tab)Virtual patch status
Previdian virtual patch guidance is available for this CVE.
AWS WAF
Cloudflare
ModSecurity
Attacker IP Indicators
Attacker IP indicators observed · available in Pro and Enterprise.
Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.
Learn about Pro API accessScanner Artifacts
Scanner and exploit-framework references linked to this CVE.
| Scanner | Reference | Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37014.yaml | 05 Aug 2026 |
Virtual Patch Detail
Compensating WAF rules for this CVE.
Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to Previdian Enterprise users.
Risk and context
Severity, weaknesses, and research context
CVSS v3.1
9.8
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
63.7%
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
Langflow <= 1.0.12 - Remote Code Execution
nuclei · Created Unknown
Timeline
From disclosure to observed exploitation
-
12:35 UTC
Virtual patch available
Compensating WAF rule available to block exploitation
-
04:30 UTC
Public PoC available
Public proof-of-concept code published
-
04:30 UTC
Nuclei template available
Scanner coverage available
-
04:36 UTC
Indicators of compromise added (59)
Indicators of compromise recorded
-
04:36 UTC
Observed by Previdian sensors
Evidence-backed exploitation signal
-
00:00 UTC
CVE published
Vulnerability disclosed publicly
-
00:00 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2024-37014
Free JSON includes basic KEV fields{
"cve_id": "CVE-2024-37014",
"confidence": "Confirmed",
"cvss_score": 9.8,
"cvss_estimated": false,
"epss_score": 0.63674,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": true
},
"sensor_telemetry": { "attempts": 990, "sensors": 3 }
}