[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBp7hhBPut7qOU5YQaLYvtgs5VHoOwjmw-uUVqpNslic":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":60},"4d8c3be9-95e2-4dca-9134-a2fd568f46cf","critical-langflow-flaws-enable-unauthenticated-remote-code-execution","48add025-e7ad-42fb-b303-de9208746547","Critical Langflow Flaws Enable Unauthenticated Remote Code Execution","Two critical vulnerabilities in Langflow (CVE-2026-93680 and CVE-2026-110186) allow unauthenticated attackers to bypass authentication and execute arbitrary code on affected servers running versions 1.0.0 through 1.12.8. The situation is compounded by a dangerous default configuration — `LANGFLOW_AUTO_LOGIN` — that automatically grants superuser access, dramatically widening the attack surface. The availability of a public Metasploit module means exploitation requires minimal skill, making unpatched instances trivial targets. This incident highlights how insecure defaults combined with delayed patching create critical, easily exploitable windows of exposure.","**Immediate actions:**\n- Upgrade all Langflow instances to version 1.13.0 immediately, as it is the only available fix for both CVEs.\n- Disable or explicitly override the `LANGFLOW_AUTO_LOGIN` default setting to prevent automatic superuser login on any instance that cannot be patched right away.\n- Block public internet access to Langflow endpoints via firewall or reverse proxy until patching is confirmed complete.\n\n**Long-term improvements:**\n- Establish a policy of reviewing and hardening default configurations for all third-party AI\u002FML tooling before deployment to production environments.\n- Maintain a continuously updated software inventory (SBOM) so that newly disclosed CVEs can be mapped to deployed assets within hours, not days.\n- Implement emergency patching SLAs (e.g., critical CVEs patched within 24–48 hours) enforced through your vulnerability management program.\n\n**Detection measures:**\n- Deploy runtime monitoring and anomaly detection on AI\u002FML infrastructure to flag unexpected code execution or unauthenticated API calls.\n- Integrate threat intelligence feeds into your vulnerability scanner so that CVEs with public exploit modules (e.g., Metasploit) are automatically escalated to critical priority.\n- Review authentication and access logs for Langflow instances retroactively to identify any exploitation attempts that may have already occurred.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities; the existence of a public Metasploit module for these flaws makes timely patching a direct compliance obligation under this article.","Requirement 6 mandates the development and maintenance of secure systems and software, including prompt installation of security patches, which would have required upgrading Langflow to 1.13.0 before attackers could leverage the published exploits.","SI-2 requires organisations to identify, report, and correct information system flaws promptly; applying this control would have mandated an urgent upgrade to Langflow 1.13.0 as soon as the CVEs were published.","Running Langflow versions 1.0.0–1.12.8 with known critical CVEs is a textbook instance of this risk category, underscoring the need to track component versions and update them before public exploits emerge.","A continuous vulnerability management process would have identified the critical Langflow CVEs immediately upon disclosure and enforced timely remediation before public exploits like the Metasploit module could be weaponised against unpatched instances.","This control explicitly requires organisations to obtain timely information about technical vulnerabilities and take appropriate action, which would have driven immediate patching or mitigation of these critical Langflow flaws.","The authentication bypass flaw and the auto-login superuser default directly violate this control, which requires robust identity management and access control mechanisms to prevent unauthenticated access to systems.","published","2026-11-02T14:23:14.59444+00:00","2026-11-02T14:23:14.569+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fcritical-langflow-flaws-could-let.html","critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers-0bed56","Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":48,"name":49,"slug":50,"description":51,"color":52},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[54],{"id":55,"date":56,"edition":57,"title":58,"audio_url":59},"14636927-94bc-47e1-826b-afe87fa1e745","2026-11-02","afternoon","ThreatNoir Afternoon Brief — November 2","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-02\u002Fthreatnoir-afternoon-brief-2026-11-02.mp3",[61,65,69],{"slug":62,"name":63,"problem":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":66,"name":67,"problem":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":50,"name":70,"problem":71},"Automated patch management","Known holes get closed in days, not months."]