docs: CVE advisory and patch release 1.5.1

[mendonk]

• Update README.md to include CVE-2025-57760 advisory and recommendation for remediation.
• Add links to SECURITY.md and the repository's advisories page to README.md.
• Update SECURITY.md to include CVE-2025-57760.

Summary by CodeRabbit

• Documentation
  • Enhanced README warning: converted to a bullet list, retained guidance to upgrade to >=1.3, added note to upgrade to >=1.5.1 addressing CVE-2025-57760, and linked to Security Policy and Advisories.
  • Expanded SECURITY.md: added explicit disclosures for CVE-2025-3248 (fixed >=1.3.0) and CVE-2025-57760 (fixed >=1.5.1); clarified auto-login and authentication behavior across versions, noted default changes in 1.5 and removal in 1.6, and linked to API key/authentication documentation.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbit review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Documentation updates: README warning reworked into a list with added CVE and security links; SECURITY.md expanded with explicit CVE disclosures, version-specific authentication behavior notes, and guidance on AUTO_LOGIN and superuser CLI implications. No code or public API changes.

Changes

Cohort / File(s)	Summary
README advisory update README.md	Converted single-line caution to blockquote list; kept upgrade note for >=1.3, added CVE-2025-57760 note for >=1.5.1; appended links to Security Policy and Security Advisories.
Security disclosures and auth behavior SECURITY.md	Replaced brief guidance with explicit CVEs: CVE-2025-3248 (fixed >=1.3.0) and CVE-2025-57760 (privilege escalation via CLI, fixed >=1.5.1); detailed AUTO_LOGIN and LANGFLOW_SKIP_AUTH_AUTO_LOGIN behavior across versions; linked to API key/auth docs and noted deprecations/removals.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix: enforce authentication for superuser cli command #9152 — Implements authentication enforcement for the langflow superuser CLI, aligning with the documented CVE-2025-57760 guidance.
• feat(auth): update AUTO_LOGIN authentication to enforce API key or JWT requirement #8513 — Code-level changes requiring API key/JWT for AUTO_LOGIN, matching the updated authentication behavior documentation.
• docs: langflow 1.5 auto-login security doc #9057 — Documentation updates around pre-1.5 auto-login/auth bypass and upgrade recommendations, overlapping with this PR’s security docs.

Suggested labels

documentation, size:M, lgtm

Suggested reviewers

• jordanrfrazier
• aimurphy
• ogabrielluiz

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch docs-cve-advisory-and-patch-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbit in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbit in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbit gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbit read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbit help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbit ignore or @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbit summary or @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbit or @coderabbitai anywhere in the PR title to generate the title automatically.

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

SECURITY.md (1)

61-70: Contradictory statements about API key requirement in 1.5; clarify default vs enforced behavior.

Line 65 states 1.5 requires an API key, while lines 66–68 say auth is skipped by default in 1.5 if both env vars are set (and one is default-true). This is confusing and can mislead operators.

-In Langflow version 1.5, a Langflow API key is required to authenticate requests.
-Setting `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` and `LANGFLOW_AUTO_LOGIN=true` skips authentication for API requests. However, the `LANGFLOW_SKIP_AUTH_AUTO_LOGIN` option will be removed in v1.6.
-
-`LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` is the default behavior, so users do not need to change existing workflows in 1.5. To update your workflows to require authentication, set `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=false`.
+In Langflow 1.5, API key authentication is supported.
+However, when `LANGFLOW_AUTO_LOGIN=true` and `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` (the default in 1.5), API requests bypass authentication.
+To require authentication in 1.5, set `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=false`.
+The `LANGFLOW_SKIP_AUTH_AUTO_LOGIN` option will be removed in v1.6; update workflows accordingly.

🧹 Nitpick comments (3)

README.md (1)

17-20: Align version notation and punctuation for consistency.

Use explicit patch versions and end bullets with periods.

-> - Users must update to Langflow >= 1.3 to protect against [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
+> - Users must update to Langflow >= 1.3.0 to protect against [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248).

-> - Users must update to Langflow >= 1.5.1 to protect against [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r)
+> - Users must update to Langflow >= 1.5.1 to protect against [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r).

SECURITY.md (2)

51-53: Minor formatting: terminate sentences and standardize version string.

Adds periods; keeps “>= 1.3.0” consistent with README suggestion.

-**CVE**: [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
-**Fixed in**: Langflow >= 1.3.0
+**CVE**: [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248).
+**Fixed in**: Langflow >= 1.3.0.

---

54-60: Tighten wording and finish sentences.

Clarify impact sentence and add period after “Fixed in”.

-### Privilege Escalation via CLI Superuser Creation (Fixed in 1.5.1)
+### Privilege Escalation via CLI Superuser Creation (Fixed in 1.5.1)

-A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command `langflow superuser` to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account.
+A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE can invoke the internal CLI command `langflow superuser` to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a non-admin.

-**CVE**: [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r)
-**Fixed in**: Langflow >= 1.5.1
+**CVE**: [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r).
+**Fixed in**: Langflow >= 1.5.1.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between fafdc36 and eb4bdbc.

📒 Files selected for processing (2)

• README.md (1 hunks)
• SECURITY.md (1 hunks)

🧰 Additional context used

🪛 LanguageTool

SECURITY.md

[grammar] ~51-~51: There might be a mistake here.
Context: .../nvd.nist.gov/vuln/detail/CVE-2025-3248) Fixed in: Langflow >= 1.3.0 ### Pri...

(QB_NEW_EN)

---

[grammar] ~58-~58: There might be a mistake here.
Context: ...security/advisories/GHSA-4gv9-mp8m-592r) Fixed in: Langflow >= 1.5.1 ### No ...

(QB_NEW_EN)

🔇 Additional comments (1)

README.md (1)

16-20: Good addition: clear, actionable security guidance surfaced prominently.

Elevating both CVEs into the CAUTION block with direct links is the right call.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud