CISA Flags an Actively Exploited Langflow Code Execution Flaw as Agent Builders Come Under Attack

A critical unauthenticated flaw in the popular Langflow agent building tool lets attackers chain two API endpoints to run code, and CISA added it to its Known Exploited Vulnerabilities catalog with a federal patch deadline of August 7. A public proof of concept and a Metasploit module are now circulating.