Langflow Fixes Critical Authorization Bypass Vulnerability

What changed

Langflow has released an important update to address a critical authorization bypass vulnerability. This flaw, identified as an Insecure Direct Object Reference (IDOR), allowed authenticated attackers to manipulate requests and access workflows belonging to other users.

The vulnerability was present in versions prior to 1.9.1 and has now been resolved in the latest release.

Who is affected

Users of Langflow prior to version 1.9.1 are at risk due to this vulnerability. The following groups and products are particularly impacted:

Organizations utilizing Langflow for AI-powered agents and workflows should be aware of this security issue.

• Langflow users leveraging the platform for workflow automation.
• Developers integrating Langflow into their applications.
• Businesses relying on Langflow for AI-driven solutions.

What to do

It is crucial for all Langflow users to update to version 1.9.1 or later to mitigate the risk associated with this vulnerability. Regular updates and security assessments should be part of the operational protocol.

Additionally, users should review their access controls and ensure that proper security measures are in place.

• Upgrade to Langflow version 1.9.1 or higher immediately.
• Conduct a security audit of existing workflows and user permissions.
• Stay informed about future updates and vulnerabilities.