Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

Two critical vulnerabilities in Langflow, an open-source AI workflow tool, allow unauthenticated attackers to bypass security and execute arbitrary code remotely. These flaws affect all versions from 1.0.0 to 1.12.8 and are fixed only in version 1.13.0. IBM disclosed the issues and noted a Metasploit module exploits one flaw when automatic login is enabled.