Critical · 1 source · latest 1h

IBM patches critical Langflow flaws enabling authentication bypass and code execution

CRITICAL · VULNERABILITYIBMredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

IBM has released Langflow 1.13.0 to fix four vulnerabilities, two rated critical with a CVSS score of 9.8. The flaws allow authentication bypass, leaking of API credentials and arbitrary code execution, and one of the critical issues can be exploited without an account. IBM has also patched three medium-severity flaws in the Hono framework used inside Langflow.

For IT people · Written by AI from 1 source · Wrong?

What to do

Upgrade Langflow OSS to version 1.13.0, available from PyPI or as a Docker image.
Back up the database, secret key and uploaded files before upgrading.
If the deployment uses automatic login, prepare the existing account for password sign-in as described in IBM's upgrade instructions.
Upgrade Hono to version 4.13.5.

Written by AI from the sources, checked against them

Read the full story at the source