Critical Langflow Flaws Enable Unauthenticated RCE: Detection and Remediation Guide

IBM disclosed two critical vulnerabilities in Langflow, the popular open-source platform for building AI agents and LLM-powered workflows, that allow a remote, unauthenticated attacker to bypass authentication and execute arbitrary code on the underlying server. Every release from version 1.0.0 through 1.12.8 is affected, and the only fix is upgrading to version 1.13.0.

This is the kind of vulnerability class that should get your immediate attention. AI workflow orchestration tools like Langflow sit in a uniquely sensitive position in modern environments: they hold API keys for LLM providers, credentials for vector databases, tokens for third-party SaaS integrations, and — by design — they execute user-supplied code as part of their workflow engine. A pre-authentication remote code execution flaw in this class of tooling is not a theoretical problem; it is a direct path to credential theft, lateral movement, and full compromise of your AI/ML infrastructure.

Neither flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of disclosure, which means there is no confirmed in-the-wild exploitation yet. Do not read that as a reason to defer patching. Public disclosure of a pre-auth RCE in a widely deployed open-source project historically triggers exploitation within days to weeks as researchers and threat actors reverse-engineer the patch. Treat this as an emergency change.

Technical Analysis

Affected Products and Versions

• Product: Langflow (open-source AI agent and workflow builder)
• Affected versions: 1.0.0 through 1.12.8 (all releases)
• Fixed version: 1.13.0
• Typical deployment: Python application, commonly run via pip install langflow, Docker container, or hosted on Linux servers behind uvicorn/FastAPI. Default web interface listens on TCP port 7860.
• Vulnerability handling: Reports for Langflow are coordinated through IBM.

The Flaws

The disclosure describes two distinct but complementary critical flaws:

1. Authentication Bypass — A remote attacker with no account can circumvent Langflow's authentication controls and interact with protected API endpoints. Langflow exposes a rich REST API (under /api/v1/) for managing flows, components, credentials, and build operations. An authentication bypass against this API surface effectively hands an attacker administrative control of the platform: they can read stored global variables and credentials, modify existing flows, and create new components.

2. Arbitrary Code Execution — The second flaw allows execution of arbitrary code on the server. Langflow's core functionality involves dynamically evaluating Python code within custom components and workflow nodes — this is a feature, not an accident. When an attacker can reach the code-validation/build endpoints or inject malicious component code without authentication, the application itself becomes the execution vehicle. The payload runs with the privileges of the Langflow service account.

Chained together, these flaws produce a worst-case scenario: no credentials required, no user interaction required, full code execution on the host. From there, the attacker inherits everything the Langflow process can touch — OpenAI/Anthropic/Azure OpenAI API keys, database connection strings, cloud credentials in environment variables, and any internal network reachability the server has.

Attack Chain (Defender's View)

1. Attacker identifies an internet-exposed (or internally reachable) Langflow instance, typically on TCP 7860.
2. Attacker sends crafted requests that bypass authentication to reach protected /api/v1/ endpoints.
3. Attacker submits malicious Python code via component creation or code-validation/build functionality.
4. The Langflow server process (Python/uvicorn) executes the attacker-controlled code.
5. Post-exploitation: credential harvesting from environment variables and Langflow's credential store, persistence installation, and lateral movement.

Exploitation Status

• CISA KEV: Not listed at time of disclosure.
• Confirmed in-the-wild exploitation: None reported.
• Assessment: Pre-auth RCE in a project of Langflow's popularity (tens of thousands of GitHub stars, broad enterprise AI adoption) is a high-probability exploitation candidate once technical details or a PoC emerge. Patch before that happens.

Detection & Response

Post-compromise, the highest-fidelity signal is the Langflow server process spawning child processes it has no business spawning — shells, interpreters, download cradles. The second signal is HTTP access to authenticated API endpoints from sources with no legitimate session history. Hunt both.

Sigma Rules

---
title: Langflow Server Process Spawning Shell or Interpreter
description: Detects the Langflow Python/uvicorn server process spawning shells, script interpreters, or system utilities, consistent with post-exploitation of the unauthenticated RCE vulnerability affecting Langflow 1.0.0-1.12.8.
id: 8f2c4a1e-5b7d-4e39-a1c6-9d3e7f2b8a41
status: experimental
references:
  - https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'langflow'
      - 'uvicorn'
  selection_child_img:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
  condition: selection_parent and selection_child_img
falsepositives:
  - Legitimate Langflow workflows invoking system commands via custom components (rare; investigate any hits)
level: high
---
title: Langflow Server Spawning Shell on Windows Host
description: Detects a Python process running Langflow on Windows spawning cmd.exe, PowerShell, or other LOLBins, indicating potential exploitation of the Langflow unauthenticated RCE flaws.
id: 3d9a6c52-1f4b-48e7-b2d5-7a1c9e4f6b83
status: experimental
references:
  - https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/09
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\pythonw.exe'
    ParentCommandLine|contains: 'langflow'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom Langflow components legitimately invoking subprocesses (uncommon on Windows servers)
level: high
---
title: Unauthenticated Access to Langflow Sensitive API Endpoints
description: Detects HTTP requests to Langflow API endpoints associated with code execution and component management, which may indicate exploitation of the authentication bypass flaw. Tune the source scope to exclude known developer subnets.
id: 6b1e8d94-2c7a-4f53-9e1b-4d8c2a7f5e96
status: experimental
references:
  - https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    c-uri|contains:
      - '/api/v1/validate/code'
      - '/api/v1/custom_component'
      - '/api/v1/build'
      - '/api/v1/flows'
      - '/api/v1/variables'
      - '/api/v1/credentials'
  selection_method:
    c-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate developers and CI/CD pipelines interacting with the Langflow API — baseline known automation sources and alert on anomalies
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for Langflow server processes spawning suspicious child processes. It works against Defender for Endpoint (DeviceProcessEvents) on managed hosts and against Syslog/CEF-ingested Linux process audit data (Syslog, CommonSecurityLog) in Sentinel.

// Hunt 1: Langflow/uvicorn spawning shells or interpreters (Defender for Endpoint)
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","sh","bash","dash","zsh","curl","wget","nc","ncat","python","python3","perl","certutil.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has_any ("langflow", "uvicorn")
   or ProcessCommandLine has "langflow run"
| where FileName in~ (suspiciousChildren) or ProcessCommandLine has_any (suspiciousChildren)
| where not(InitiatingProcessCommandLine has "langflow run" and FileName =~ "python")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: Web requests to Langflow code-execution-relevant API endpoints (via CommonSecurityLog / WAF / reverse proxy ingestion)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("/api/v1/validate/code", "/api/v1/custom_component", "/api/v1/build", "/api/v1/credentials", "/api/v1/variables")
| where RequestMethod in ("POST", "PUT", "PATCH", "DELETE")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, RequestMethod, RequestContext
| order by RequestCount desc;

Velociraptor VQL

Use this artifact to identify Langflow instances on Linux servers and enumerate any suspicious child processes or unexpected network listeners — useful both for exposure discovery (finding shadow Langflow deployments you didn't know about) and for post-exploitation triage.

-- Identify running Langflow instances, their children, and their network exposure
LET langflow_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'langflow|uvicorn'

LET children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM langflow_procs)
  AND Name =~ '(sh|bash|dash|curl|wget|nc|ncat|perl|python)'

LET listeners = SELECT Pid, Name, Laddr, Lport, Status
FROM netstat()
WHERE Lport = 7860 AND Status = 'LISTEN'

SELECT * FROM langflow_procs
UNION ALL
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime FROM children

Remediation & Verification Script

Run this on Linux hosts to identify installed Langflow versions, upgrade to the fixed release, and confirm no vulnerable version remains. Adapt the paths for virtualenv or containerized deployments — for containers, rebuild from a pinned langflow==1.13.0 base rather than patching in place.

#!/bin/bash
# Langflow vulnerability remediation - upgrade all instances to >= 1.13.0
# Run as root or with sudo on application servers

echo "=== [1/4] Discovering installed Langflow versions ==="
# Check system-wide and common virtualenv locations
for PIP in $(which pip3) /opt/*/bin/pip /home/*/.venv/bin/pip /srv/*/venv/bin/pip; do
  [ -x "$PIP" ] 2>/dev/null || continue
  VER=$($PIP show langflow 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
  [ -n "$VER" ] && echo "FOUND: $PIP -> langflow $VER"
done

echo "=== [2/4] Checking for running Langflow processes and exposed listeners ==="
ps aux | grep -E 'langflow|uvicorn' | grep -v grep
ss -tlnp | grep -E ':7860'

echo "=== [3/4] Upgrading Langflow to 1.13.0 ==="
for PIP in $(which pip3) /opt/*/bin/pip /home/*/.venv/bin/pip /srv/*/venv/bin/pip; do
  [ -x "$PIP" ] 2>/dev/null || continue
  if $PIP show langflow >/dev/null 2>&1; then
    echo "Upgrading via $PIP ..."
    $PIP install --upgrade "langflow>=1.13.0"
  fi
done

echo "=== [4/4] Verifying fixed version ==="
VULN_FOUND=0
for PIP in $(which pip3) /opt/*/bin/pip /home/*/.venv/bin/pip /srv/*/venv/bin/pip; do
  [ -x "$PIP" ] 2>/dev/null || continue
  VER=$($PIP show langflow 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
  if [ -n "$VER" ]; then
    MAJOR=$(echo $VER | cut -d. -f1); MINOR=$(echo $VER | cut -d. -f2)
    if [ "$MAJOR" -lt 1 ] || { [ "$MAJOR" -eq 1 ] && [ "$MINOR" -lt 13 ]; }; then
      echo "STILL VULNERABLE: $PIP -> $VER"; VULN_FOUND=1
    else
      echo "OK: $PIP -> $VER"
    fi
  fi
done
[ $VULN_FOUND -eq 0 ] && echo "REMEDIATION COMPLETE" || { echo "ACTION REQUIRED: vulnerable versions remain"; exit 1; }

# NOTE: Restart the Langflow service after upgrade, e.g.:
# systemctl restart langflow  (or your container/service manager equivalent)

Remediation

Immediate (within 24–48 hours):

1. Upgrade to Langflow 1.13.0. This is the only fix — there is no configuration workaround that fully mitigates the flaws. For pip installs: pip install --upgrade "langflow>=1.13.0". For Docker: pull the 1.13.0 image and redeploy; never patch running containers in place. Restart the service and verify the running version.
2. Inventory your exposure. Langflow is frequently deployed by data science and AI teams outside IT's visibility — classic shadow IT. Scan your address space and cloud environments for listeners on TCP 7860 and for Langflow HTTP fingerprints (the /api/v1/health endpoint and default UI title are reliable markers). Check container registries for Langflow images.
3. Remove internet exposure. There is almost never a legitimate reason for Langflow to be reachable from the public internet. Place it behind your VPN, ZTNA broker, or at minimum an authenticating reverse proxy with IP allowlisting. If it must be reachable, enforce SSO in front of it independent of Langflow's own authentication.
4. Hunt before you patch. Because the flaws are pre-authentication, a vulnerable internet-facing instance may already be compromised. Run the process-spawn and API-access hunts above against historical logs (retain at least 30 days back) before wiping evidence with an upgrade. Look specifically for the Langflow/uvicorn process spawning shells, unexpected outbound connections from the server, and new or modified flows/credentials in the platform.

Short term (this week):

5. Rotate credentials stored in Langflow. If any instance was internet-exposed or reachable from untrusted network segments, rotate every secret it could access: LLM provider API keys, vector database credentials, cloud IAM keys in environment variables, and any credentials stored in Langflow's global variables/credential store. Assume compromise of secrets on any exploited host.
6. Constrain the service account. Run Langflow under a dedicated low-privilege account with no sudo, no cloud instance metadata access (or IMDSv2 with hop limit 1), and egress filtering that permits only required API endpoints (LLM providers, vector stores). Code execution by design means the blast radius is defined entirely by what the process can reach.
7. Segment AI infrastructure. Langflow servers should live in a dedicated segment with no direct path to domain controllers, production databases, or crown-jewel systems. AI orchestration tooling should be treated as untrusted-code execution infrastructure — because functionally, that is what it is.

Strategic:

8. Establish an AI/ML toolchain asset inventory and patch SLA. Langflow, Flowise, Dify, and similar tools are proliferating rapidly with minimal security governance. They execute code and hold secrets — they deserve the same (or tighter) patch cadence and exposure controls as your traditional internet-facing infrastructure.
9. Monitor IBM's Langflow security advisories via the Langflow GitHub repository for the formal advisory and any subsequent technical write-ups; update detection rules when IoCs or PoC details emerge.

Bottom Line

Pre-authentication RCE in AI orchestration tooling is the 2026 version of pre-auth RCE in VPN concentrators and exchange servers: internet-reachable, credential-rich, and increasingly targeted. The absence of KEV listing today is a window, not a reprieve. Patch to 1.13.0 now, hunt for prior compromise, and get these platforms off the public internet.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub