Critical Langflow Vulnerabilities Enable Unauthenticated Remote Code Execution
IBM identifies severe security flaws in Langflow versions 1.0.0 through 1.12.8.
1Critical Security Flaws Discovered
IBM recently disclosed four critical vulnerabilities affecting Langflow versions 1.0.0 through 1.12.8. These flaws allow unauthenticated remote attackers to bypass security controls or execute arbitrary code on affected servers. The discovery highlights significant risks for organizations utilizing this open-source tool for building AI agents and complex automated workflows.
2Model Context Protocol Risks
One primary vulnerability involves unauthenticated remote code execution via the Model Context Protocol. Attackers can interact with the MCP endpoint without credentials to enumerate available tools. While current Metasploit modules only demonstrate session initiation and tool listing, the underlying architectural flaw presents a severe risk for unauthorized system access.
3Auto-Login Feature Vulnerability
The LANGFLOW_AUTO_LOGIN setting, enabled by default in version 1.12.8, automatically grants superuser access without authentication. IBM identified this as a major security control failure, noting it should strictly remain in development environments. This feature effectively bypasses standard login procedures, leaving production servers exposed to any remote actor targeting the endpoint.
4Remediation and Versioning
Langflow version 1.13.0, released on October 22, serves as the only official fix for these critical vulnerabilities. This update disables the dangerous auto-login feature by default. Organizations currently running versions 1.12.8 or earlier must prioritize upgrading to 1.13.0 immediately, as IBM has provided no alternative workarounds for unpatched servers.
5Scope of Affected Releases
The vulnerability range is extensive, covering every release from 1.0.0 up to 1.12.8. Although Metasploit modules suggest a narrower impact window, IBM’s comprehensive bulletin confirms the broader scope. Users should verify their specific deployment version, as PyPI records indicate no intermediate patches were released between 1.12.8 and the 1.13.0 fix.
6Broader Vulnerability Landscape
Beyond these four primary flaws, IBM published records for 29 additional Langflow vulnerabilities on October 29. One specific issue, CVE-2026-104339, carries a 9.8 severity rating and also permits arbitrary code execution. These findings indicate a systemic security challenge within the platform's codebase, necessitating rigorous auditing for all AI-integrated infrastructure deployments.
7CISA Catalog Status
As of the October 30 update, these specific flaws are not yet listed in CISA’s Known Exploited Vulnerabilities catalog. However, six other Langflow vulnerabilities, including CVE-2026-9198, are already tracked. The absence of these new flaws from the catalog does not diminish their severity, as active exploit modules are already circulating in frameworks.
8Strategic Security Implications
These incidents underscore the necessity of securing AI-specific middleware against unauthorized access. Organizations must treat AI agent frameworks as high-value targets, ensuring that authentication protocols are strictly enforced. Moving forward, security teams should focus on strengthening attack surface visibility and preparing operations for emerging threats inherent in rapidly evolving AI tooling.