Executive brief
IBM Langflow OSS, a tool used for building and deploying AI applications, contains a critical security flaw in its login system. By default, the software allows anyone with network access to generate a high-level administrative token without providing a password. This could allow an attacker to take full control of the application, access sensitive AI workflows, and potentially compromise the data or operations managed by the platform.
Technical details
A critical authentication bypass vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.10.0 due to the 'AUTO_LOGIN' configuration being enabled by default. The /api/v1/login/auto_login endpoint fails to require credentials and instead issues long-lived (365-day) superuser bearer tokens to any requester. This is further exacerbated by permissive Cross-Origin Resource Sharing (CORS) settings that allow wildcard origins, potentially enabling drive-by token theft. An unauthenticated remote attacker can exploit this to obtain full administrative access to the Langflow instance. The vulnerability is addressed in version 1.10.1.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.0
Timeline
- 2026-07-02: advisory: Initial publication by IBM
- 2026-07-17: disclosed: NVD publication date
- 2026-07-02: patched: Remediation available in version 1.10.1