Langflow: two critical flaws allow unauthenticated code execution, update to 1.13.0

What happened

On 2 November 2026, two critical vulnerabilities in Langflow were made public. Langflow is the open-source tool for building AI workflows, agents and chatbots. The flaws let an attacker bypass authentication or execute arbitrary code on the server, without needing an account. Langflow version 1.13.0 fixes both issues.

The source data contains no reports of active exploitation so far. Langflow instances are often reachable from the internet, and earlier Langflow flaws were attacked soon after disclosure. Treat this update as urgent.

Who is affected

All Langflow releases from 1.0.0 up to and including 1.12.8 are affected. This includes installations via pip, Docker containers and other self-hosted deployments.

The risk is highest for instances reachable from the internet without an extra access layer in front of them. Code execution in Langflow runs with the rights of the Langflow process. That process often has access to:

• API keys for language model providers
• database credentials
• other secrets stored in flows and environment variables

What to do now

1. Find all Langflow instances you or your customers run, including test and demo setups that are easy to forget.
2. Back up your Langflow configuration, environment files and database or data volume before upgrading.
3. Upgrade to Langflow 1.13.0.
   • For pip installations, run pip install --upgrade langflow==1.13.0 in the environment Langflow uses.
   • For Docker, change the image tag to 1.13.0, pull the new image and recreate the container.
4. Restart the Langflow service and confirm that the web interface loads and your flows still run.
5. Restrict access if Langflow does not need to be public. Bind it to localhost or an internal network, or put it behind a reverse proxy with authentication or a VPN. Allow only known IP addresses in the firewall.
6. If you cannot upgrade right away, block access from the internet to the Langflow port until you can.
7. Rotate secrets if an affected instance was reachable from the internet. This covers API keys, database passwords and tokens stored in Langflow or its environment.

How to check whether you are affected

• Check the installed version.
  • For pip, run pip show langflow.
  • For Docker, run docker ps and look at the image tag in use.
  • Any version from 1.0.0 to 1.12.8 is vulnerable.
• Check whether the Langflow port is reachable from outside, for example with a port scan from an external host.
• Review the Langflow and reverse proxy logs for unusual requests from unknown IP addresses, especially requests to API endpoints from addresses that never logged in.
• On the host or in the container, look for signs of compromise:
  • unexpected processes
  • new cron jobs or users
  • unknown files in temporary directories
  • outgoing connections to unfamiliar addresses
• Check for flows or components in Langflow that you did not create.

If you find signs of compromise, take the instance offline. Rebuild it from a clean image with version 1.13.0, and rotate every credential it had access to.

Sources

• https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html