IBM security advisories reveal severe authentication bypass and arbitrary code execution flaws in Langflow versions 1.0.0 through 1.12.8, driven by default auto-login configurations.
Developers utilizing the AI workflow platform must update to version 1.13.0.
According to an update issued by IBM on October 28, the issue affects every version of Langflow from 1.0.0 to 1.12.8. These versions are affected by a total of four security issues. The two most serious issues, rated 9,8 out of 10, allow login bypass or code execution without requiring any password or account. Another issue requires a simple account to create code that executes commands, while a fourth issue also requires an account to access sensitive data.
Automatic login and attack tests
In the affected versions, the automatic login setting is enabled by default and bypasses the checks. A tool has already been discovered online that uses this loophole to log in to passwordless systems and view their available tools.
The solution and the upgrade
Version 1.13.0, released on October 22, fixes the issues and disables automatic login by default. Administrators are advised to back up their database, secret key, and uploaded files, and to upgrade their software. The following day, IBM published reports of other security issues, designating versions 1.12.4 and 1.12.5 as fixes for those cases.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)