Critical flaws in Langflow AI-agent builder let outsiders take over servers; only fix is upgrading
Every version from 1.0.0 through 1.12.8 is affected, IBM says, and there is no workaround besides moving to Langflow 1.13.0.
Companies that run their own copy of Langflow, a free tool for building AI agents, should upgrade right away, according to a security bulletin from IBM, which handles the project's vulnerability reports. Two of the flaws could let an attacker with no account get past the login or run their own code on the server.
Langflow lets people build AI agents, programs that carry out tasks on their own, by connecting blocks on a screen instead of writing all the code. Similar tools include n8n and Microsoft's Copilot Studio. Because these servers often hold keys to company accounts and AI services, a takeover can spread.
What is wrong
IBM rated two flaws 9.8 on the 0-to-10 CVSS scale that security teams use to judge danger. One lets an outsider bypass the sign-in; the other lets them run arbitrary code, meaning any commands they want. IBM said one can be reached through the Model Context Protocol, a common way for AI apps to find and use tools. A third flaw, rated 8.8, lets a user with a basic account trick Langflow's built-in Agentic Assistant into running system commands.
Every release from 1.0.0 through 1.12.8 is affected. IBM offers no workaround. The fix is version 1.13.0, released Oct. 22, which also turns off "auto-login," a setting that signs users in as administrators without a password, according to The Hacker News. It reported that the flaws were not on the U.S. government's list of known-exploited bugs as of Oct. 30, but that public attack software already uses the login bypass to list a server's tools.
Before upgrading, back up the database, secret key and uploaded files, IBM advises.
Source: IBM security bulletin, Oct. 28, 2026 (updated Oct. 29); The Hacker News, Nov. 2, 2026.