Websites
Your AI Helper Builder Needs Updates Too: The Langflow Warning
Langflow is a free tool that developers use to build AI apps and workflows. It has a serious security flaw, and attackers have been trying to use it.
What is the problem
In versions before 1.9.0, any logged-in user, even one who is not an admin, could run commands on the server. A second serious flaw was fixed in version 1.10.3. Both are rated 9.9 out of 10.
Are attackers really using it?
Yes. Security researchers saw 1,706 attack attempts from 28 addresses. Attempts went up sharply from October 11, with 333 on October 11 and 316 on October 15. These were on test servers set up to attract attackers, not on real business sites.
Attackers tried to:
- Steal secret keys stored on the server
- Run quick test commands
- Reach the main computer behind the tool
What to do
If your developer uses Langflow:
- Update it.
- Turn off automatic login.
- Use strong passwords.
- Do not leave it open to the public internet.
- Check the logs for strange activity.
What this means for you
AI building tools are software too. They need the same updates as a website. If a developer built an AI helper for your business, ask what it runs on and who keeps it up to date.
Sources
Want a website your customers can trust, kept safe and up to date? Get a free quote.
Questions about this topic
Do I use Langflow?
Probably not, unless a developer built an AI workflow for you. Ask them what tools it runs on.
What is the one thing to do?
Ask your developer to update it and keep it off the open internet.