VulnerabilitiesCritical Langflow flaws allow unauthenticated code execution
IBM says every Langflow release from 1.0.0 to 1.12.8 carries two critical bugs, and only version 1.13.0 contains the fix.
2 Nov 2026
Critical Langflow Flaws Allow Unauthenticated RCE and Auth Bypass
IBM disclosed two critical vulnerabilities in Langflow, an open-source tool for building AI agents and workflows, that could let an unauthenticated remote attacker bypass authentication or execute arbitrary code on servers. Every release from 1.0.0 through 1.12.8 is affected; the issues are fixed only in version 1.13.0.
Record updated 2 November 2026
Impact
Unauthenticated attackers could potentially bypass authentication or achieve remote code execution on servers running vulnerable Langflow versions (1.0.0–1.12.8); fixed in 1.13.0.
Our coverage
VulnerabilitiesSources
- thehackernews.comhttps://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html