Critical Langflow flaws allow unauthenticated code execution

Two critical vulnerabilities in Langflow, an open-source tool for building AI agents and workflows, could let a remote attacker with no account bypass authentication or run arbitrary code on affected servers, IBM disclosed in the week before 2 November 2026, according to The Hacker News.

Every Langflow release from 1.0.0 through 1.12.8 is affected. The only fix is version 1.13.0. There is no mention of a workaround or partial mitigation for earlier releases, so upgrading is the remedy on offer.

Langflow's vulnerability reports go to IBM, which is why the disclosure comes from the company rather than from the project itself, the report said. Neither of the two flaws appears in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue, the list the agency maintains of bugs it has confirmed are being used in attacks.

The combination described by IBM is the kind that security teams tend to treat as urgent. An authentication bypass removes the login barrier in front of a service. Remote code execution means an attacker can run commands of their choosing on the machine. Together, and reachable without credentials, they reduce the work needed to take over a server to whatever is required to reach it over the network.

That matters more than usual for a tool of this type. Langflow is used to assemble AI agents and automated workflows, which in practice means the servers running it often hold the connection details, API keys and model credentials that those workflows use to reach other systems. A machine that builds and runs agents is rarely isolated from the services those agents talk to.

The available reporting does not say how the flaws were found, who reported them, or what the underlying programming errors are. It does not identify CVE numbers, severity scores or the specific components at fault. There is no indication in the reporting that either flaw has been exploited against real deployments, and no claim either way about whether exploit code is public.

The practical step for anyone running Langflow is to check the version in use. Any build in the 1.0.0 to 1.12.8 range is covered by the advisory. Because the flaws are described as exploitable without authentication, instances exposed directly to the internet are the obvious first priority, followed by those reachable from wider internal networks. Teams that cannot upgrade immediately may wish to confirm whether their instances are reachable from outside their own network at all.

The status of the issue is resolved from the vendor side: a fixed release exists and is available. Whether that fix reaches deployed systems is a separate question, and one that has historically taken time for self-hosted developer tools, which are often installed once for a project and then left running without a patching routine.

The Agentic Times has not independently verified the technical details of the flaws. The disclosure, as reported, comes from IBM.