--- title: "🛡️ Langflow 1.0.0 to 1.12.8 Affected: IBM Says the Only Fix Is Upgrading to 1.13.0｜AI Security Daily" description: "The one thing that most deserves a slot in today's maintenance schedule: IBM's security advisory notes that the open source AI agent workflow tool Langflow has four vulnerabilities, affecting versions spanning 1.0.0 through 1.12.8, and with no alternative mitigations offered officially, the only path is upgrading to 1.13.0. Elsewhere, the UK NCSC's annual report warns about critical infrastructure risks ahead of 2028, and why the report's real focus isn't actually \"novel AI attacks,\" I'll tell you shortly." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-11-03" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-11-03T02:00:00.000Z" category: "AI Security Daily" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "Langflow", "IBM安全公告", "身分驗證繞過", "MCP", "NCSC", "關鍵基礎設施", "弱點管理"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ Langflow 1.0.0 to 1.12.8 Affected: IBM Says the Only Fix Is Upgrading to 1.13.0｜AI Security Daily ## Opening The one thing that should go straight onto today's ops schedule: an IBM security bulletin reports four vulnerabilities in Langflow, the open source AI agent workflow tool, affecting versions 1.0.0 through 1.12.8. There are no alternative mitigations from the vendor, so the only path forward is upgrading to 1.13.0. Elsewhere, the UK NCSC's annual report warns about risks to critical infrastructure before 2028, and why the report's real takeaway isn't actually "new AI-powered attacks" is something I'll get to shortly. Today's material only includes two attributed news items, so the third section is replaced with an action list you can execute immediately. ## Today's AI Security Focus ### 1. IBM bulletin: four Langflow vulnerabilities, two remotely triggerable without authentication, fixed in 1.13.0 - **What happened**: According to The Hacker News, a security bulletin IBM published on October 28 and updated on the 29th lists four vulnerabilities in Langflow (an open source AI agent and workflow building platform). Two of them are rated 9.8 by IBM, covering authentication bypass and improper control of code generation respectively, and the report states that neither requires an account to trigger remotely. There is also an 8.8 issue and a 6.5 issue involving credential exposure. The report also mentions that a public attack framework already includes a module referencing the authentication bypass weakness. We couldn't independently verify that point in this episode, but it's enough to move patching up the priority list. As for CVE identifiers, the four numbers listed in the secondary reporting show clear inconsistencies in both format and serial number magnitude, so we're not reproducing them one by one here. Please treat the official identifiers in IBM's security bulletin and the NVD entries as authoritative. - **Scope of impact**: Affected versions are 1.0.0 through 1.12.8, meaning every release prior to 1.13.0, with 1.13.0 itself being the fixed version. Teams self-hosting Langflow, particularly those exposing the admin interface or MCP (the protocol that lets models call external tools and data sources) endpoints directly to the public internet, face the highest risk, since these services typically hold both LLM API keys and data source credentials. - **Defensive recommendations**: Upgrade to 1.13.0. IBM provides no alternative mitigations. Before upgrading, back up your flows and configuration, verify 1.13.0 compatibility in a test environment before going to production, move the admin interface behind a reverse proxy or VPN, rotate every API key and data source credential on the platform, and finally audit flow creation and modification logs to confirm no unexplained new flows have appeared. - **Source**: The Hacker News () - **Verification note**: The CVE identifiers and CVSS vectors in this item come from a single media report and have not been cross-checked against IBM's official bulletin page or NVD entries. Defer to the official entries. ### 2. UK NCSC annual report: AI-assisted attacks on critical infrastructure likely before 2028 - **What happened**: According to Dataconomy, citing the UK National Cyber Security Centre (NCSC) annual cyber security report, director Richard Horne stated in his report address that as state-level actors and criminal organizations expand their use of artificial intelligence, the UK is likely to face AI-assisted attacks on critical infrastructure before 2028. The report notes that AI will very likely increase both the scale and efficiency of hostile cyber operations, allowing ransomware to find and exploit long-tolerated weaknesses at speeds that were previously hard to achieve. The report also identifies China-linked cyber activity as the most sophisticated and persistent challenge facing the UK. That is the report authors' assessment, and we're relaying it as stated. - **Scope of impact**: This is a trend assessment rather than a single incident, but it's worth reading for operators in energy, water, healthcare, and transportation, as well as any organization with a large external service footprint and long patch cycles. The point worth noting is that the attacks described in the report amplify existing weaknesses rather than opening an entirely new attack surface. - **Defensive recommendations**: Treat "days of exposure for known unpatched weaknesses" as a tracked metric. For example, set explicit remediation deadlines for Critical vulnerabilities on external-facing services, report completion rates and overdue lists monthly, and shore up your asset inventory to confirm there are no unclaimed internet-facing hosts. - **Source**: Dataconomy, citing the NCSC annual cyber security report () - **Verification note**: This episode only obtained third-party reporting. Phrasing such as "before 2028" and "China-linked activity" should be cross-checked against the original Annual Review report page on the NCSC website before being quoted externally. ## Today's Action List (editorially compiled, not a separate incident) Muyan distills the two items above into four things you can act on today. First, inventory whether anyone inside or outside the company is self-hosting Langflow, including data science team experiment environments and PoC machines, since those are the ones most often forgotten. Second, confirm whether those services are exposed to the public internet, and reduce the exposure surface before worrying about upgrades. Third, schedule a change window for the upgrade to 1.13.0, with backups done first and compatibility tested first. Fourth, bring AI platforms into your existing vulnerability management process and asset inventory instead of leaving them in the gray zone of "experimental projects." ## Closing The line worth remembering today: AI platforms are already production-facing services, so manage them to production-facing standards. Spend ten minutes running through your asset inventory and confirm whether any Langflow instance inside or outside the company sits between versions 1.0.0 and 1.12.8. If there is, open the upgrade change ticket today. I'm Muyan, see you tomorrow. --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-11-03) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. - [ai-security-monitor defensive security](https://blog.markkulab.net/en/tools/ai-security-monitor): Your website is live. Who checks its certificates, security settings and known vulnerabilities? A self-hosted Security Hub brings website scans and host monitoring together, deduplicates findings and compares scans after fixes. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物日報](https://blog.markkulab.net/en/category/open-source-weekly): A daily two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動日報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport every day — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Every day, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷日報](https://blog.markkulab.net/en/category/ai-marketing): Every day, two hosts break down the latest in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安日報](https://blog.markkulab.net/en/category/ai-security): Every day, two hosts cover the latest where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.