IBM repairs four Langflow bugs, two with a 9.8 CVSS score

IBM released repairs for four bugs in Langflow, an open-source tool that assembles AI agents and workflows. Two bugs have a 9.8 score on the CVSS scale. One lets attackers use the system without the login, and one lets them operate code on the server with no login. Attackers used Langflow bugs to get credentials before. The last attack was in August.

How it works

• One bug comes from a repair that was not full. It lets an attacker use functions that must have a login.
• The other bug lets a remote attacker with no login operate code through MCP tool listing. MCP is a standard procedure to connect AI agents and tools.

The numbers

One more bug has a high score. It lets an attacker send commands, but the attacker must have a low-privilege account. The last bug has a 6.5 score and shows API credentials. IBM also repaired three moderate bugs in Hono, a web tool that Langflow uses.

What is not known

The source does not tell if attackers use these four bugs. IBM tells users to copy the database, the secret key and the uploaded files before the upgrade. Users who have automatic login must change the login account to password sign-in.

Insight: Langflow bugs come fast and attackers follow fast

Previdian recorded 1,423 attack tries on a different Langflow bug from 19 September, and 333 of them on 11 October. This new set includes a bug from a repair that was not full. This seems to show that attackers move fast, and a repair that is not full gives them more time. Leaders must set a short repair time for AI tools.