Critical Langflow Vulnerability: Unauthenticated RCE and Auth Bypass

What Happened

A critical Langflow vulnerability affects every release from 1.0.0 through 1.12.8, and the only fix is version 1.13.0. IBM said last week that the flaws let a remote attacker with no account bypass authentication or run arbitrary code.

Langflow is an open-source tool for building AI agents and workflows. Teams adopt it to prototype and automate AI processes, and it is often connected to internal data and systems. That makes an unauthenticated code execution bug more than a dev-tool problem. If an attacker can run code on the server, they can often reach the data and systems that Langflow can reach.

MSPs should treat this like any critical vulnerability in a tool they host or manage. The patch is clear, the affected versions are known, and the exposure window depends on how quickly you can find and update every instance.

Timeline

A patch is already available, so the timeline that matters now is yours. Once a critical vulnerability is public, attackers can start reverse engineering the fix.

• November 2, 2026Public reporting on the Langflow flaws is published. IBM's disclosure is described as having come the week before.

Who Is Affected

Any organization running Langflow 1.0.0 through 1.12.8 is affected. That includes MSPs using Langflow internally and MSPs who host it for clients.

Because the attack needs no account, the risk is not limited to users with login credentials. Any instance reachable over the network is exposed, and the more accessible the instance, the more urgent the patch.

Assume exposure until you prove otherwise. Check production systems, dev servers, staging environments, and any client infrastructure where Langflow may have been installed for a pilot or proof of concept.

Why This Matters

Langflow sits close to data. AI workflow tools are usually given access to the same systems they automate, and that includes files, databases, and APIs. Code execution on that server can quickly become access to those systems.

An authentication bypass removes the first barrier. The attacker doesn't need to phish a password or guess credentials, they just need to reach the service. For MSPs, that means the exposure is not tied to user behavior, it is tied to network reachability.

The practical question is not whether the flaws are being exploited right now. It is whether you can find every instance and patch it before someone else does. That is the same question for most critical vulnerabilities, and the answer is usually found in your asset inventory.

For an MSP, this kind of vulnerability is also a contract issue. Clients expect you to know what is running in their environment and to act before a problem becomes an incident. A clear patching process is the difference between a routine maintenance item and an emergency.

Technical Details: The Langflow Vulnerability

Langflow is an open-source tool for building AI agents and workflows. IBM handles Langflow's vulnerability reports. Two critical flaws affect every release from 1.0.0 through 1.12.8, and the only fix is version 1.13.0.

Attack vector: remote. A person with no account can exploit the flaws to bypass authentication or run arbitrary code on the server.

These two issue types are often combined in attacks. Bypassing the login gives an attacker a foothold, and code execution turns that foothold into control of the server.

What to Do This Week

Work this list in order, and don't skip the inventory step. You can't patch what you haven't found.

1. Find every Langflow instance you run or manage. Check internal servers, client environments, dev systems, and staging systems.
2. Upgrade to Langflow 1.13.0 as soon as possible. This is the only fixed release named in the report.
3. If you cannot upgrade immediately, restrict network access to the instance. Allow only trusted IPs and require VPN access where possible.
4. Review authentication and access logs for unexpected activity, especially from IPs that don't match your team or client locations.
5. Keep any exposed Langflow instances off the public internet until you have verified the upgrade.
6. Assign someone to own the follow-up for any instance that cannot be patched immediately, and track it until it is done.

What to Tell Clients

We are tracking a critical vulnerability in Langflow, an open-source tool used to build AI agents and workflows. If your environment includes Langflow, we will patch it to the fixed version this week.

The vulnerability can be exploited without a login, so the risk is not limited to users with accounts. We are checking for exposed instances and reviewing access logs as a precaution.

If you don't use Langflow, no action is needed. We will let you know if that changes.

You don't need to explain every technical detail to clients. What matters is that you have a plan, you know whether they are affected, and you're acting on it.

Frequently Asked Questions

Sources

• Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersHackernews · Reported