· ai-devtools
Langflow tool flaws allow unauthenticated code execution, bypass authentication in versions 1.0.0 through 1.12.8
A remote attacker could potentially execute arbitrary code or circumvent authentication entirely due to two severe vulnerabilities discovered in Langflow, according to IBM's announcement last week.
These security weaknesses are present across every iteration of the software, specifically versions spanning from 1.0.0 up to and including 1.12.8; the sole remediation available is upgrading to version 1.13.0. Langflow itself functions as an open-source utility designed for constructing AI agents and complex workflows, and its security findings are reported directly to IBM. It is worth noting that neither of these discovered issues is cataloged within CISA's Known vulnerabilities database.
