Langflow authentication bypass and RCE in all versions through 1.12.8

Two critical vulnerabilities in Langflow, an open-source AI agent and workflow builder, allow unauthenticated remote attackers to bypass authentication and execute arbitrary code. All versions from 1.0.0 through 1.12.8 are affected. Version 1.13.0 contains the fixes. IBM disclosed the flaws; they are not yet in CISA's KEV catalog. Organizations using Langflow should immediately upgrade to 1.13.0.