Langflow
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by CSO OnlineIBM patches critical Langflow flaws enabling authentication bypass and code execution
- Vulnerability reported by GBHackersIBM discloses seven Langflow OSS flaws, including critical unauthenticated remote code execution
- Vulnerability reported by The Hacker NewsCritical Langflow flaws allow unauthenticated attackers to run code on servers
Recent news
IBM patches critical Langflow flaws enabling authentication bypass and code execution
IBM has released Langflow 1.13.0 to fix four vulnerabilities, two rated critical with a CVSS score of 9.8. The flaws allow authentication bypass, leaking of API credentials and arbitrary code execution, and one of the critical issues can be exploited without an account. IBM has also patched three medium-severity flaws in the Hono framework used inside Langflow.
IBM discloses seven Langflow OSS flaws, including critical unauthenticated remote code execution
IBM has disclosed seven vulnerabilities in Langflow OSS, including critical authentication bypass and code injection flaws that can be exploited remotely without credentials. The bulletin covers Langflow versions 1.0.0 through 1.12.8 and advises administrators to upgrade to 1.13.0.
Critical Langflow flaws allow unauthenticated attackers to run code on servers
IBM disclosed two critical flaws in Langflow, an open-source tool for building AI agents and workflows, that allow a remote, unauthenticated attacker to bypass authentication or execute arbitrary code. Every release from 1.0.0 through 1.12.8 is affected, and version 1.13.0 is the only fix.