{"data":{"id":"bdd13ffb-32b8-4950-97a0-228b1505302f","title":"Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers","summary":"IBM disclosed two critical Langflow flaws that let a remote attacker with no account bypass authentication or run arbitrary code. Every release from 1.0.0 through 1.12.8 is affected, and neither flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of its October 30 update.","solution":"Fixed in 1.13.0. Upgrade with pip install --upgrade \"langflow==1.13.0\" or move to the langflowai/langflow:1.13.0 Docker image, after backing up the database, secret key and uploaded files. Langflow 1.13 turns automatic login off by default. IBM offers no workaround for servers that cannot upgrade yet.","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html","publishedAt":"2026-11-02T11:50:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-02T11:50:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}