Langflow's Critical Flaws Show Why Agent Tool Calls Need a Scrub Layer, Not Just a Patch

Tier A · Patch today – Before you go home

Who’s exposed: Langflow deployments reachable by unauthenticated network attackers

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Popular tool · Remote, no login · Full takeover

The Brief

IBM disclosed critical vulnerabilities in Langflow, an open-source AI agent and workflow builder.
Two of the flaws score CVSS 9.8.
Both let an unauthenticated attacker either bypass authentication or run arbitrary code, and one path runs through Model Context Protocol (MCP) tool calls.

Langflow deployments can be compromised without credentials, and the article argues that agent tool calls need a scrub layer in addition to patching.

Checklist · 4 of 10 yes

Yes	Hits tech teams	Langflow is an open-source AI agent and workflow builder that developers build and run.
No	Core infrastructure	A single AI workflow framework, not software nearly every team runs.
Yes	Popular tool	Langflow is a widely used open-source AI agent builder with broad developer adoption.
No	Exploited in the wild	DEV Community source reports no observed attacks using these flaws.
No	Public exploit	DEV Community source does not say exploit code or a PoC is published.
Yes	Remote, no login	DEV Community: both critical flaws let an unauthenticated attacker act over the network.
Yes	Full takeover	DEV Community: flaws let unauthenticated attackers bypass authentication or run arbitrary code.
No	Secrets exposed	DEV Community source reports no stolen or exposed credentials, tokens or data.
No	Supply chain	DEV Community source describes vulnerabilities, not compromised packages or updates.
No	No fix yet	DEV Community source does not say a fix is unavailable; the patch is implied.

First seen 20h ago · 1 source · Full story page · How tiers are decided