Langflow Unauthenticated Account Creation Leading to RCE

Technical Analysis

The vulnerability stems from Langflow's user registration endpoint failing to require authentication or authorization before creating new accounts. When the deployment flag NEW_USER_IS_ACTIVE is set to true (a documented and apparently common configuration), these attacker-created accounts are activated instantly rather than requiring admin approval, removing the intended gating mechanism. Once authenticated, the attacker can reach privileged endpoints within Langflow that support flow execution and code/component evaluation, which map to remote code execution (RCE) primitives in the agent-building framework. This crosses the boundary from an unauthenticated network actor to an authenticated internal user with access to agent orchestration and execution logic, effectively granting full compromise of the Langflow instance and any connected agent pipelines, credentials, or downstream tool integrations. The flaw is a classic broken-authentication/authorization issue rather than a novel agentic-AI attack pattern, but its impact is amplified because Langflow is used to construct and run LLM agent workflows with tool access.

Affected Systems

IBM Langflow

Detection Signatures

• Unexpected POST requests to /api/*/users or registration endpoints from unauthenticated/external IPs
• Spike in new user account creations without corresponding admin invite or approval logs
• Newly created accounts authenticating and immediately invoking flow-execution or code-evaluation endpoints
• Configuration audit: NEW_USER_IS_ACTIVE=true present in environment/deployment manifests
• Authentication logs showing login shortly after account creation with no email verification step

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched Langflow release beyond 1.10.0 that addresses this CVE as soon as it is available from IBM/Langflow maintainers.

2. 2

   Disable NEW_USER_IS_ACTIVE

   Set NEW_USER_IS_ACTIVE=false so new registrations require explicit admin activation before the account can authenticate.

3. 3

   Require authentication for registration

   Restrict or disable open self-registration endpoints; place Langflow behind an authenticated reverse proxy or SSO gateway.

4. 4

   Audit existing accounts

   Review all user accounts created during the vulnerable window for unauthorized or unrecognized registrations and revoke access.

5. 5

   Network segmentation

   Ensure Langflow instances are not exposed to the public internet; restrict access to trusted internal networks or VPN.

6. 6

   Monitor for RCE indicators

   Review logs for flow executions or code-evaluation calls tied to newly created or suspicious accounts.