Plan
active
Critical Langflow RCE/Auth-Bypass Flaws Fixed in v1.13.0
- Engineer — Plan: If your team uses Langflow to build AI workflows, schedule an upgrade to 1.13.0 this sprint — every release back to 1.0.0 is affected. No KEV listing or public PoC yet, but unauthenticated RCE on an AI workflow server is a high-value target worth prioritizing ahead of normal patch cadence.
- SOC/IR — Plan: No active exploitation is confirmed and no IOCs are published, but consider building detection for anomalous unauthenticated requests to Langflow API endpoints and unexpected process spawning from Langflow processes ahead of likely weaponization.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.