IBM Langflow Auto-Login Authentication Bypass Yielding Superuser Tokens
First seen Jul 18, 2026 · Updated Jul 18, 2026 · CVSS 9.8
Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.
Technical Analysis
The vulnerability resides in the /api/v1/login/auto_login endpoint, which is designed to streamline local development by auto-authenticating requests as a superuser when AUTO_LOGIN is enabled. Because this setting is enabled by default and the endpoint performs no identity verification, any network-reachable attacker can call it directly to receive a long-lived superuser bearer token. Permissive CORS configuration further compounds the issue by allowing browser-based cross-origin requests to retrieve or relay these tokens, enabling token theft from unintended origins. Once obtained, the superuser token grants full administrative access to the Langflow instance's API, allowing the attacker to read/modify agent flows, exfiltrate embedded secrets (API keys, tool credentials), deploy malicious flows, and pivot into any downstream tools or agents orchestrated by Langflow. This crosses the boundary from a single misconfigured web endpoint into full compromise of the agent orchestration layer and everything it controls.
Affected Systems
IBM Langflow OSS
Detection Signatures
- Unauthenticated POST/GET requests to /api/v1/login/auto_login from unexpected source IPs
- Bearer tokens issued without a preceding authenticated login event in access logs
- Cross-origin requests to Langflow API endpoints from untrusted or wildcard-allowed origins
- Spikes in superuser-scoped API calls shortly after auto_login token issuance
- AUTO_LOGIN=true or equivalent config flag present in production deployment manifests
Remediation Steps
- 1
Disable AUTO_LOGIN in production
Set AUTO_LOGIN to false/disabled in all production and internet-facing Langflow deployments; restrict it to isolated local development only.
- 2
Upgrade Langflow
Apply the vendor patch addressing CVE-2026-9103 as soon as it is released and verify the fix removes unauthenticated token issuance.
- 3
Harden CORS policy
Restrict allowed origins to explicit, trusted domains rather than wildcards or reflected origins for all API endpoints, especially authentication-related ones.
- 4
Rotate credentials and tokens
Rotate all superuser and API tokens issued while AUTO_LOGIN was enabled, and audit logs for unauthorized administrative actions.
- 5
Network segmentation
Ensure Langflow management/API endpoints are not exposed to the public internet; place behind VPN, mTLS, or authenticated reverse proxy.
- 6
Monitor and alert
Add detection rules for calls to auto_login and unusual superuser token creation events.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.