Langflow's AI builder has two critical holes that let strangers run code on your server
IBM says every Langflow release from 1.0.0 to 1.12.8 is vulnerable. The only fix is upgrading to 1.13.0.
Key points
- IBM disclosed two critical flaws in Langflow, an open-source tool for building AI agents, that let a remote attacker with no account bypass login or run their own code on the server.
- Every Langflow version from 1.0.0 through 1.12.8 is affected, and the only fix is upgrading to 1.13.0.
- The authentication bypass carries a near-maximum severity score.
- A second batch of bugs, including a code-execution flaw, can be abused by anyone with a low-privilege account.
- Neither issue appears on the US cyber agency's Known Exploited Vulnerabilities list yet, but Langflow has a history of being hit fast once bugs go public.
IBM has disclosed a cluster of serious flaws in Langflow, a popular open-source program that lets developers drag and drop AI agents together without writing much code. Two are rated critical. Both can be triggered by someone who has never logged in.
The worst is an authentication bypass. IBM's security bulletin describes it as an incomplete fix of an earlier auto-login problem, meaning the patch Langflow shipped the first time around didn't fully close the door. The second critical bug lets a remote attacker reach a feature called the model context protocol tool list, a built-in catalogue of actions an AI agent can take, and run their own code through it. No password required.
Which versions are affected?
Every Langflow release from 1.0.0 through 1.12.8. The fix is version 1.13.0, and there's no workaround listed. Anyone running Langflow on a server reachable from the internet should treat the upgrade as urgent.
| Detail | Value |
|---|---|
| Affected versions | 1.0.0 to 1.12.8 |
| Fixed version | 1.13.0 |
| Vendor advisory | IBM, two bulletins |
What else is in the advisory?
A second IBM bulletin lists problems that need a login but still cause real damage. One flaw lets a logged-in user run code by feeding Langflow a booby-trapped data file. The weakness is called deserialization of untrusted data, a long-standing class of bug where a program unpacks a file and executes instructions hidden inside it.
There's also a path traversal flaw that lets an attacker generate a ZIP archive on the server with filenames designed to escape the folder they're supposed to land in. If a victim unzips it with a tool that doesn't sanitise paths, files get written where they shouldn't.
IBM's bulletins also flag that several of Langflow's open-source dependencies carry their own known vulnerabilities, which the 1.13.0 upgrade resolves by pulling in fresh versions.
Should Langflow users be worried?
Yes, and the reason is history. We've covered Langflow's security record closely: our 6 October story "Langflow's Built-In Testing Tool Has No Password and Attackers Are Using It Right Now" documented three critical flaws being actively exploited, and the September report before it found over 360 attacks hitting tracking sensors in the UK in a single day. Exploit code has appeared within days of previous disclosures. There's no public evidence these new flaws are being exploited yet. That gap tends to close fast.
If you run Langflow: upgrade to 1.13.0 now, there's no partial fix. Pull your instance off the public internet if you can't upgrade today, and put it behind a VPN or an authenticated proxy. Check your logs for unexpected calls to the MCP tool listing endpoint and for new user accounts you didn't create.
The detail that should worry operators most is that the auth bypass is framed as an incomplete fix of a previous flaw. The same door, patched twice, still open. Watch for a third round.
