IBM disclosed two significant vulnerabilities in Langflow, allowing remote attackers without accounts to circumvent authentication and execute arbitrary code This article explores significant vulnerabilities langflow. . It has been plagued by vulnerabilities across all versions from 1.0.0 to 1.12.8, with the only solution being version 1.13.0.
Neither flaw is included in CISA's Known Exploited Vulnerabilities catalog, as of the October 30 update.
The four Langflow flaws in IBM's bulletin, first published on October 28 and updated the following day, are: One of the vulnerabilities is "unauthenticated remote code execution via model context protocol tool enumeration," as reported by IBM. It connects to a Langflow server's MCP endpoint without credentials, initiates a session, and displays the available tools on the server.
The code description indicates that it "bypasses authentication and should only be used in development environments." The module was tested on Langflow 1.8.4 with automatic login enabled. Version 1.12.8, released the same day, remains flawed.
One of the flaws, CVE-2026-104339, could also allow an attacker without an account to run arbitrary code, and IBM assigns it a severity rating of 9.8.
