Two critical Langflow flaws allow unauthenticated remote code execution
IBM disclosed four vulnerabilities in Langflow, a popular open-source tool for building AI agents and workflows, with the two most severe both rated 9.8 on the CVSS scale. One lets an attacker with no account at all bypass authentication through the Model Context Protocol (MCP, the standard that lets AI tools talk to each other) and gain superuser access, while the other allows arbitrary code execution on the server. Versions 1.0.0 through 1.12.8 are all affected, the fix only lands in 1.13.0, and a public Metasploit module already exploits the authentication-bypass flaw. For businesses running their own Langflow server to power AI agents, the default setting that auto-logs developers in as superuser is exactly the kind of deployment convenience that turns into a critical risk when left switched on in production.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.