What it is
Langflow is a drag-and-drop editor for building AI agents and RAG pipelines out of components such as models, prompts, vector stores and tools. Each flow can be called as an API or exposed as an MCP server, and you can edit the Python behind any component. Version 1.13.0, released on 22 October 2026, added scheduled and webhook triggers and a team and user administration API.
DataStax bought Langflow in 2024 and IBM completed its purchase of DataStax in May 2025. The hosted DataStax Langflow service shut down on 9 April 2026 and its data was deleted, so today you self-host it with Docker or Kubernetes or run Langflow Desktop.
Its security record in 2026 is poor: 33 GitHub advisories so far this year, 16 rated critical, and one unauthenticated code-execution flaw (CVE-2026-33017) was exploited within 20 hours of disclosure and added to CISA's Known Exploited Vulnerabilities list.
Our review
Langflow is a strong developer tool with a security record that should change how you deploy it. Since Flowise was archived in August 2026 it is the main fully open-source visual builder, and unlike Dify its MIT licence carries no extra conditions. It has about 156,000 GitHub stars and ships a release roughly every week.
Developers like that every component is editable Python, that flows act as both MCP clients and MCP servers, and that the same flow runs headless as an API. Version 1.13 adds schedule, webhook and Slack triggers, multi-user editing safeguards and a team administration API, and SSO now works through an external OIDC proxy such as Keycloak. Proper role-based access remains thin compared with commercial builders.
The security picture is the reason for the lower rating. GitHub lists 33 advisories for Langflow in 2026, 16 of them critical, many of them code execution through components that run Python or MCP stdio commands. CVE-2026-33017, an unauthenticated code-execution bug in the public flow build endpoint, was exploited within 20 hours of disclosure according to Sysdig, with attackers going after the OpenAI, Anthropic and AWS keys stored in flows; JFrog found the first claimed fix in 1.8.2 still exploitable. It is the second Langflow bug on CISA's exploited list after CVE-2025-3248.
The hosted DataStax service closed on 9 April 2026 and deleted remaining data, leaving self-hosting or an unpriced IBM arrangement. Dify is more polished for non-technical owners and n8n is safer ground for business automation, but neither lets a Python developer reach into every node the way Langflow does.
Where it earns its place
A Python developer at a 30-person agency prototyping client chatbots
Wire a RAG pipeline visually, then hand clients an API
Build the flow on the canvas, customise components in Python, and call it over the REST API or as an MCP server. Free to run on a small VM, but keep it on a private network and update weekly, given 16 critical advisories in 2026.
A platform team at a bank evaluating internal agent builders
Offer business units a visual builder on approved infrastructure
Run the headless runtime on Kubernetes (the docs suggest at least 2 GB RAM and one CPU per pod, three replicas) with external PostgreSQL and SSO through an OIDC proxy. Budget security review time: several 2026 advisories allowed authenticated users to run OS commands or read other users' flows.
A data engineer automating document triage
Run a scheduled flow that classifies and routes inbound files
Version 1.13 schedule and webhook triggers remove the need for an external cron. Cost is the host plus LLM calls; any component that fetches URLs should be checked, since an SSRF advisory showed protection was warn-only by default before 1.10.3.
Before you commit
- Setup
- uv pip install langflow (Python 3.10 to 3.14) and langflow run, the Docker image, or Langflow Desktop. Packaged releases disable auto-login by default; set LANGFLOW_SUPERUSER_PASSWORD. Production guidance is the headless runtime on Kubernetes with at least 2 GB RAM and one CPU per pod, three replicas and external PostgreSQL.
- Integrations
- Hundreds of components for model providers, vector stores and tools; flows exposed over REST or as MCP servers and able to call MCP servers; Slack, Google Workspace and Microsoft connection bundles; schedule and webhook triggers from 1.13.
- Data and privacy
- Self-hosted, flows and stored API keys live in your database, which makes an exposed instance a credential target. Telemetry on flow runs, components and environment is sent through Segment by default (prompts and free text excluded); set DO_NOT_TRACK=True. 33 GitHub advisories in 2026, 16 critical, including CISA-listed CVE-2026-33017.
- Cost at scale
- MIT, no licence fee. A production runtime of three 2 GB, 1-CPU replicas plus a PostgreSQL instance of around 4 GB and 2 CPUs fits a small Kubernetes cluster; the larger cost is model calls and the engineering time to patch weekly. Enterprise support is through IBM, unpriced.
- Limits
- 1,220 open issues and pull requests. Frequent releases with security fixes make pinning an old version risky. Role-based access is limited, components that run Python are a standing code-execution surface, and there is no hosted option.
What's good
- MIT licence with no extra conditions
- Every component is editable Python
- Flows run as APIs, MCP servers or scheduled jobs
- Weekly releases
What's not
- 33 security advisories in 2026, 16 critical, one exploited in the wild
- SSO only via an external OIDC proxy; thin role-based access
- No managed cloud since April 2026
- Production needs PostgreSQL and several replicas
Best for
Developers prototyping agents and RAG pipelines who want a visual editor and a permissive licence.
Alternatives
Langflow: common questions
- Is Langflow worth it?
- Langflow is the most capable fully MIT visual agent builder left standing, and also one of the most attacked, so treat every instance as something to patch weekly and never expose directly. We rate it 3.8 out of 5.
- How much does Langflow cost?
- Free and open source (MIT). No official hosted cloud since April 2026; the enterprise route is through IBM, with no published price.
- What are the downsides of Langflow?
- 33 security advisories in 2026, 16 critical, one exploited in the wild; sSO only via an external OIDC proxy; thin role-based access; no managed cloud since April 2026; production needs PostgreSQL and several replicas.
- Who is Langflow best for?
- Developers prototyping agents and RAG pipelines who want a visual editor and a permissive licence.
- How much does Langflow cost for a team or in production?
- MIT, no licence fee. A production runtime of three 2 GB, 1-CPU replicas plus a PostgreSQL instance of around 4 GB and 2 CPUs fits a small Kubernetes cluster; the larger cost is model calls and the engineering time to patch weekly. Enterprise support is through IBM, unpriced.
- Is Langflow safe for company data?
- Self-hosted, flows and stored API keys live in your database, which makes an exposed instance a credential target. Telemetry on flow runs, components and environment is sent through Segment by default (prompts and free text excluded); set DO_NOT_TRACK=True. 33 GitHub advisories in 2026, 16 critical, including CISA-listed CVE-2026-33017.
- What are the best Langflow alternatives?
- The closest alternatives we have reviewed are Dify and n8n.
Answers checked Oct 23, 2026.