By ByteBot
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 4, demanded federal remediation by August 7, and attackers were already scanning — 650 exploitation attempts from 244 IP addresses across 41 countries before the deadline even arrived. If you run Langflow in any network-reachable configuration, the question is not whether to act. It is whether you acted before your API keys walked out the door.
Two Requests, Full Control
The exploit chain is uncomfortably simple. Step one: call the auto_login endpoint with no credentials. In Langflow’s default configuration — LANGFLOW_AUTO_LOGIN=true, which ships out of the box — the endpoint mints a SUPERUSER token for any network caller without checking who’s asking. Step two: send arbitrary Python to the validate/code endpoint with that token. Langflow passes it to Python’s built-in exec(). Two HTTP requests. Full remote code execution. No authentication required.
The CVSS score of 9.8 is not hype. Affected versions span Langflow 1.0.0 through 1.10.0. IBM patched it in 1.10.1, disclosed July 17, but patch adoption has been slow — and public proof-of-concept code is already circulating.
The Real Target Isn’t the Server
Here’s what makes this vulnerability genuinely dangerous beyond the raw RCE: Langflow is an AI orchestration layer. It holds credentials for every service wired into it — model provider API keys (OpenAI, Anthropic, Gemini, DeepSeek), cloud credentials, database connection strings, vector store tokens, and SaaS connector secrets. A compromised Langflow host isn’t just a breached server. It’s a skeleton key to your entire AI stack.
This isn’t theoretical. In early July 2026, Sysdig documented JADEPUFFER — the first fully documented agentic AI ransomware campaign. It exploited a prior Langflow vulnerability, swept compromised hosts for LLM API keys and cloud credentials, then deployed ENCFORGE ransomware targeting AI model weights and vector databases. The infrastructure for doing this automatically, at scale, already exists. This new vulnerability is another entry point into the same playbook.
Shadow Deployments Are the Actual Problem
The default configuration being vulnerable is bad. The shadow deployment problem is worse. Langflow gets spun up by individual developers experimenting with agent pipelines — from a README, in an afternoon, on a shared cloud account. No IT review. No patch cadence. No monitoring. These instances sit exposed on port 7860 with API keys intact, and security teams frequently don’t know they exist.
Censys counted roughly 7,000 publicly exposed Langflow instances earlier this year. If your organization has more than a handful of developers working on AI projects, the right assumption is that at least one Langflow instance is running somewhere you haven’t audited. Find it before someone else does.
What to Do Right Now
Upgrade first. The fix is straightforward:
uv pip install langflow==1.10.1Version 1.10.2 is also available and includes additional path traversal fixes. Either version resolves the vulnerability.
If you cannot upgrade immediately, disable auto-login — but set environment variables directly in your deployment, not a .env file. Some affected versions silently ignored .env configurations, making the setting ineffective. Use Docker -e, Kubernetes ConfigMap/Secret, or your cloud provider’s environment config:
LANGFLOW_AUTO_LOGIN=false
LANGFLOW_SUPERUSER=your-admin-user
LANGFLOW_SUPERUSER_PASSWORD=strong-password-hereRemove public internet access if neither option is immediately feasible. Bind to loopback or put a VPN in front until the instance is patched.
Rotate all credentials stored in flows running on any network-reachable host during the affected version window. API keys, cloud credentials, database passwords — treat them as compromised. Check API provider dashboards and cloud access logs for anomalous activity from Langflow’s IP address.
A Pattern Worth Taking Seriously
This is the fifth significant Langflow vulnerability to hit CISA’s KEV catalog. The platform has a consistent pattern: disclosure, slow patch adoption, active exploitation. A previous flaw was weaponized within 20 hours of its patch release.
If you’re shipping production agents on Langflow, it needs real deployment discipline — secrets management through a vault, no public-facing ports without authentication in front, and an upgrade process that responds in hours rather than weeks. AI orchestration tools have quietly inherited enormous trust in the modern stack. They hold the keys to models, data, and cloud resources. That makes them high-value targets, and attackers figured this out before most defenders did. Treat Langflow like the production infrastructure it already is.
