The patch for Langflow’s newest critical flaws is not a pip install. It is an identity project, and plenty of teams will discover that halfway through the upgrade.

IBM, which takes vulnerability reports for the open-source AI agent builder, published a security bulletin on 28 October covering Langflow OSS 1.0.0 through 1.12.8. Two of the flaws are rated CVSS 9.8 and need no account: CVE-2026-93680, an improper-authentication bypass, and CVE-2026-110186, arbitrary code execution through improper control of code generation. IBM describes one issue as an “incomplete remediation of an auto-login security control”. The fix is version 1.13.0, and IBM lists no workaround. The Hacker News reports that 1.12.8, released the same day as 1.13.0 on 22 October, still has the flaws, and that neither critical CVE was in CISA’s Known Exploited Vulnerabilities catalog as of its 30 October update. Six other Langflow flaws already are.

Here is the part worth arguing about. The Hacker News notes that automatic login is enabled by default in 1.12.8, and that with it on, Langflow logs users in as superusers without prompting. The bulletin does not say whether servers with automatic login switched off are exposed to the bypass, so we shouldn’t claim either way. What the vendor’s own documentation does say is blunt: automatic login lets anyone who can reach the server act as the superuser, and an API key carries the privileges of the user who made it, including access to flows, components and the database. Langflow 1.13 turns automatic login off by default and adds reusable connections to Google Workspace, Microsoft 365 and Slack accounts. An agent builder is where mailbox and chat access end up. That makes its login screen an identity control, whether or not anyone in the business treated it that way.

The upgrade itself shows the gap. Langflow tells you to set a superuser password before you start 1.13, or you may not be able to sign in. Its documentation also says that disabling automatic login does not revoke sessions or API keys already issued. So the order matters: patch, force password sign-in, then rotate keys and connected credentials. A tool a developer team installed for a pilot may never have reached the asset register, so for APAC security leaders the first question is where these servers are running.

What security leaders should do:

• Find every Langflow instance, including laptops and test servers, and check whether any is reachable beyond localhost. Langflow’s own documentation says never to expose its ports directly to the internet.
• Upgrade to 1.13.0, not 1.12.8. Back up the database, secret key and uploaded files first, and set the superuser password before first start.
• Treat anything a reachable server held as exposed. Rotate Langflow API keys and the model, mail and chat credentials stored in flows.
• Put an owner and a patch SLA on AI builder tools, the same as any internet-facing application.

An AI agent platform with no login is not a development convenience. It is an admin console with a friendly name.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #AgenticAI #IdentitySecurity #APAC #CyberSecurity

Sources: IBM security bulletin · The Hacker News · Langflow 1.13 release post · Langflow authentication documentation