Businesses using Langflow to build AI agents, internal automation or LLM-based workflows should review their deployments after IBM disclosed two critical vulnerabilities affecting the platform. According to the reported disclosure, the flaws could allow a remote attacker without an account to bypass authentication or run arbitrary code on vulnerable servers.

The issue matters in particular for organisations experimenting with self-hosted AI tooling, internal copilots or workflow automation systems connected to business data, APIs and cloud services. If a vulnerable Langflow instance is exposed to the internet, the risk may extend beyond the application itself to connected systems and credentials.

What happened

IBM reported two critical security flaws in Langflow, an open-source platform used to build AI agents and automated workflows. The reported issue affects releases from 1.0.0 through 1.12.8, and the fix is available in version 1.13.0.

Based on the source report, one flaw could let an unauthenticated attacker bypass authentication, while the other could enable arbitrary code execution on the server. That combination is especially serious because it can turn an externally reachable AI application into an entry point for broader compromise.

The source also states that the vulnerabilities are not listed in CISA's Known Exploited Vulnerabilities catalog at the time referenced. That does not mean the risk is low; it means publicly confirmed active exploitation had not been reflected there in the cited reporting.

Why it matters for European businesses

Many European SMEs and digital teams are adopting open-source AI tools to prototype assistants, automate repetitive tasks and connect large language models to internal knowledge bases or external business systems. Langflow is relevant in this context because it is designed for building AI workflows and agents, often with access to APIs, documents, databases and automation logic.

If attackers can access such a server without authentication or execute code remotely, the business impact can go beyond downtime. Potential consequences may include:

• Exposure of API keys, model credentials or cloud tokens stored on the server
• Access to internal documents or connected data sources used by AI workflows
• Manipulation of automated processes, prompts or agent behaviour
• Use of the compromised host as a foothold for lateral movement in a wider environment
• Service disruption for customer-facing or internal AI tools

For companies deploying AI internally without the same controls used for core production systems, this is also a reminder that AI infrastructure should be treated as part of the organisation's normal security surface.

Who may be affected

The issue is most relevant to organisations that self-host Langflow or run it in cloud environments for development, testing or production use. This may include:

• SMEs piloting AI agents or workflow automation
• IT teams running internal LLM applications
• Digital agencies building AI-powered workflows for clients
• E-commerce businesses using AI for support, search, operations or content processes
• Teams exposing Langflow instances to the public internet for remote access or integrations

Companies that do not use Langflow directly may still be affected indirectly if a supplier, agency or software partner uses it within managed services or internal delivery environments.

What companies should consider

Organisations using Langflow should first verify which version is deployed and whether any instance is internet-accessible. The reported fix is version 1.13.0, so upgrading should be the immediate priority for affected environments.

• Identify deployments: Inventory self-hosted, cloud and development instances of Langflow.
• Patch promptly: Upgrade affected versions to 1.13.0 where possible.
• Reduce exposure: Restrict public access to admin or workflow-building interfaces unless there is a clear operational need.
• Review secrets: Rotate API keys, tokens and credentials if there is any sign a server may have been exposed or compromised.
• Check logs and monitoring: Look for unusual access patterns, unexpected process execution or configuration changes.
• Segment AI systems: Avoid running experimental AI tooling with broad access to production data or critical systems.
• Assess third parties: Ask agencies, integrators or vendors whether Langflow is used in environments connected to your business.

For regulated or security-sensitive organisations, the incident also underlines the need to include AI orchestration tools in standard vulnerability management, access control and incident response processes.