A critical RCE in IBM Langflow forces a CISA emergency deadline — the exact mechanism (two chained endpoints) is precisely what we just verified is absent from our own code
On 4 August, CISA added a critical Langflow flaw (CVSS 9.8) to its catalogue of actively exploited vulnerabilities, with an emergency deadline of 7 August for US federal agencies — yesterday. Langflow, acquired by IBM through the DataStax deal, orchestrates AI-agent workflows. We took that trigger seriously and checked our own code against exactly this kind of flaw, the same day.
The mechanism is simple and brutal: an unauthenticated attacker calls the /api/v1/auto_login endpoint, which, in the default configuration (LANGFLOW_AUTO_LOGIN=true), hands a super-admin token to any caller on the network. With that token, they then call /api/v1/validate/code to run arbitrary Python via exec(). No authentication required — the exploit works on a default install, with nothing special configured. Proof-of-concept code has been circulating since July, and active exploitation has been observed in the wild. It is not an isolated incident for the platform: Forkast also lists CVE-2026-33017 (unauthenticated RCE, exploited 20 hours after disclosure) and CVE-2026-55255 (an IDOR flaw used to siphon LLM provider keys, cloud credentials and database secrets) — a repeated pattern of flaws at the authentication boundary of the agentic infrastructure stack.
The marketing reflex would be to cite this flaw and say "look, the others are vulnerable, we're not". We preferred to check before writing anything. A full grep of our entire backend (server/src/*.ts) confirms it: no endpoint grants a privileged token without authentication — nothing equivalent to auto_login exists in our code. The only 4 places where AppManager spawns an external process (the assistant chat, the mail engine, the push to the "Sent" mailbox, and audio transcription via ffmpeg) all pass their arguments as an array, never as an interpolated string — the class of shell injection this kind of flaw typically exploits has no purchase here. And above all: AppManager does not expose to any user a visual workflow builder that executes arbitrary uploaded definitions — the very architecture that makes Langflow vulnerable to this class of flaw does not exist on our side, not because we "secured" it, but because we never built it.
For AppH
- The check is not an empty claim: it is a real grep of all server code, done on the day of disclosure, and the full reasoning (which files, which calls, why they are safe) is documented in our own internal decision log.
- The architectural difference is real, not cosmetic: a tool that executes user-uploaded workflow definitions has an attack surface that we simply chose not to build.
Against / the honest limit
- Three critical flaws in 2026 on a single agent platform show that the whole category is young and under-tested — our own agent-invocation code (the assistant chat) is just as recent and has not received the level of adversarial scrutiny that a tool used by thousands of companies like Langflow naturally attracts.
- A grep you run yourself is not an independent security audit — it is an honest starting point, not a certification. Nobody having found a flaw in our code does not mean there is none, only that nobody has yet looked with the intensity currently aimed at Langflow.
The temptation, when a competitor is on fire in the news, is to use it as proof that we did things right. We prefer to be honest about what this check really proves: it proves that we looked, on a specific day, with a specific method, and found nothing comparable — not that we are safe forever. The real lesson of Langflow is not "avoid AI-agent tools", it is that the boundary between "recommending an action" and "executing it" must stay watertight even under pressure to ship fast. At AppManager, our assistant can read an image you send it or spawn a process to transcribe a call — but none of those capabilities gives it the power to modify your business data or trigger an action with real consequences without a human validating it first. That remains true today because we checked it today, not because we decreed it once and stopped looking.
Verified by a human at AppH