# Critical Langflow Vulnerabilities Enable Unauthenticated Remote Code Execution IBM identifies severe security flaws in Langflow versions 1.0.0 through 1.12.8. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b873bf8b-b734-4f79-ab61-836e91d19695 ## Critical Security Flaws Discovered IBM recently disclosed four critical vulnerabilities affecting Langflow versions 1.0.0 through 1.12.8. These flaws allow unauthenticated remote attackers to bypass security controls or execute arbitrary code on affected servers. The discovery highlights significant risks for organizations utilizing this open-source tool for building AI agents and complex automated workflows. ## Model Context Protocol Risks One primary vulnerability involves unauthenticated remote code execution via the Model Context Protocol. Attackers can interact with the MCP endpoint without credentials to enumerate available tools. While current Metasploit modules only demonstrate session initiation and tool listing, the underlying architectural flaw presents a severe risk for unauthorized system access. ## Auto-Login Feature Vulnerability The LANGFLOW_AUTO_LOGIN setting, enabled by default in version 1.12.8, automatically grants superuser access without authentication. IBM identified this as a major security control failure, noting it should strictly remain in development environments. This feature effectively bypasses standard login procedures, leaving production servers exposed to any remote actor targeting the endpoint. ## Remediation and Versioning Langflow version 1.13.0, released on October 22, serves as the only official fix for these critical vulnerabilities. This update disables the dangerous auto-login feature by default. Organizations currently running versions 1.12.8 or earlier must prioritize upgrading to 1.13.0 immediately, as IBM has provided no alternative workarounds for unpatched servers. ## Scope of Affected Releases The vulnerability range is extensive, covering every release from 1.0.0 up to 1.12.8. Although Metasploit modules suggest a narrower impact window, IBM’s comprehensive bulletin confirms the broader scope. Users should verify their specific deployment version, as PyPI records indicate no intermediate patches were released between 1.12.8 and the 1.13.0 fix. ## Broader Vulnerability Landscape Beyond these four primary flaws, IBM published records for 29 additional Langflow vulnerabilities on October 29. One specific issue, CVE-2026-104339, carries a 9.8 severity rating and also permits arbitrary code execution. These findings indicate a systemic security challenge within the platform's codebase, necessitating rigorous auditing for all AI-integrated infrastructure deployments. ## CISA Catalog Status As of the October 30 update, these specific flaws are not yet listed in CISA’s Known Exploited Vulnerabilities catalog. However, six other Langflow vulnerabilities, including CVE-2026-9198, are already tracked. The absence of these new flaws from the catalog does not diminish their severity, as active exploit modules are already circulating in frameworks. ## Strategic Security Implications These incidents underscore the necessity of securing AI-specific middleware against unauthorized access. Organizations must treat AI agent frameworks as high-value targets, ensuring that authentication protocols are strictly enforced. Moving forward, security teams should focus on strengthening attack surface visibility and preparing operations for emerging threats inherent in rapidly evolving AI tooling. ## Sources covering this story - https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._