Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

Langflow, an open-source tool for building AI agents and workflows, contains two critical flaws that could be exploited by unauthenticated remote attackers. These vulnerabilities allow attackers to either bypass authentication or execute arbitrary code on servers. The flaws are present in all Langflow releases from version 1.0.0 to 1.12.8. The issues can be resolved by updating to version 1.13.0, as it is the only fixed version. IBM reported the vulnerabilities, which have not been listed in CISA's Known Exploited Vulnerabilities catalog.