Langflow Registration Endpoint Missing Authentication - Admin Takeover & Open Relay

Technical Analysis

The vulnerability stems from a missing authentication check on Langflow's user/admin registration endpoint, allowing an unauthenticated remote attacker to modify the stored administrator email field directly via API request. This enables account takeover primitives such as triggering password resets to attacker-controlled addresses, and separately allows the server's mail-sending functionality to be abused as an open relay for spam or phishing campaigns. The entry point is a network-exposed HTTP endpoint rather than an agent tool call, but the impact crosses into the agent layer because Langflow instances often hold API keys, model credentials, and connected tool/plugin configurations that an admin-level attacker could subsequently access or modify. No agent-to-agent propagation is described, but a compromised Langflow instance could be leveraged as a foothold to poison flows, tools, or credentials used by downstream agents.

Affected Systems

Langflow (IBM Langflow OSS)

Detection Signatures

• Unauthenticated POST/PUT requests to Langflow registration or admin-email update endpoints
• Unexpected changes to admin email address in Langflow user/config tables without corresponding authenticated session
• Anomalous outbound SMTP traffic volume from Langflow server host
• Outbound email showing Langflow server as relay origin for unrelated recipient domains
• Access logs showing registration endpoint hit without prior auth token/session cookie

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched Langflow release beyond 1.10.0 once available from IBM/Langflow maintainers that enforces authentication on the registration endpoint.

2. 2

   Restrict network exposure

   Place Langflow instances behind authentication proxies, VPNs, or firewalls so registration and admin endpoints are not reachable from the public internet.

3. 3

   Audit admin accounts

   Review current admin email addresses and account settings for unauthorized changes; rotate credentials and API keys stored within Langflow flows.

4. 4

   Monitor outbound mail

   Add monitoring/rate-limiting for outbound SMTP traffic from Langflow hosts to detect relay abuse.

5. 5

   Disable unused registration functionality

   If self-registration is not required, disable or gate the registration endpoint entirely.