Langflow Review 2026: A Free, Capable Agent Builder That Leaves the Security Work to You
Langflow is an open-source visual builder for AI agents, RAG pipelines and MCP servers, owned by IBM through DataStax. The software is free under the MIT license, but the hosted DataStax Langflow service was removed on 9 Apr 2026, so today you run it yourself. We worked out what that costs, what the security record means for a server you expose, and what tends to break first.
There are no affiliate links in this review. Every Langflow link goes straight to langflow.org, its docs or GitHub.
| Owned by | IBM, through DataStax (repository created 8 Feb 2023) |
| What it is | Visual builder for agents, RAG and MCP servers, extensible in Python |
| Price | $0 (MIT); you pay for servers and model calls |
| Hosted cloud | None today: DataStax Langflow removed 9 Apr 2026 |
| Paid support | IBM Elite Support, price not published |
Worth it for Python-literate teams who want a fast canvas for agents and can run a locked-down server; a poor fit if you wanted a hosted product or will expose it to many users.
Who it is for: developers and technical teams who want to wire models, tools, vector stores and MCP servers together on a canvas, test them in a built-in Playground, and then call each flow as an API or expose it as an MCP tool, dropping into Python whenever the canvas runs out. What it costs: nothing for the software. Langflow is MIT-licensed; you install the Python package, run the Docker image or download Langflow Desktop for Mac or Windows, and you pay for your own server and model API keys. As of 23 Oct 2026 there is no hosted Langflow to buy: the DataStax service was removed on 9 Apr 2026.
MIT license; no paid tier listed
4 GiB DigitalOcean droplet plus daily backups
on GitHub; 33 of them published in 2026
in CISA’s Known Exploited Vulnerabilities catalogue
The three catches. First, there is no managed option any more, even though langflow.org still offers a “free, enterprise-grade cloud” and IBM’s product page still mentions “Langflow Cloud”; plan on hosting it. Second, Langflow’s own security page says it “neither enforces isolation between users within a single Langflow process, nor restricts access to the local disk or network resources”: every user who can edit a flow can, by design, run Python on your server unless you switch that off. Third, the record shows what happens to exposed servers: six Langflow flaws are on CISA’s list of vulnerabilities exploited in the wild, one with known ransomware use, so an internet-facing install has to stay on a current release (1.12.8 or 1.13.0 today).
Not a hands-on test: JAVIS has not installed Langflow or built a flow in it. This review is built from langflow.org, the Langflow docs and release notes, the GitHub repository, its issues and security advisories, IBM and DataStax pages, CISA’s catalogue, Docker Hub, PyPI download statistics, Hacker News, and the server and model vendors’ price pages, all as of 23 Oct 2026 unless another date is given. The workloads in the cost examples are invented and labelled.
A canvas of components that becomes an API, an MCP server or an agent tool, running wherever you put it.
You drag components onto a canvas: chat input, a model, an agent, tools such as web search or a calculator, a vector store or knowledge base, and outputs. Each component is Python underneath and its code can be edited. You test in the Playground, then call the flow over the REST API, embed it as a chat widget, or let MCP clients use it as a tool. Langflow brings no model of its own; every model call runs on a provider key you add, or a local model such as one served by Ollama.
One of the most-starred AI projects on GitHub, now an IBM asset, shipping a release about every eight days.
10,241 forks; 23 Oct 2026
langflowai/langflow on Docker Hub, 23 Oct 2026
package langflow, last month (pypistats.org)
to 22 Oct; latest 1.13.0
The repository was created on 8 Feb 2023 by Logspace, a small Brazilian team. DataStax bought it in April 2024; IBM announced in February 2025 that it would acquire DataStax, and today DataStax’s docs carry the line “an IBM Company”, IBM sells support for Langflow, and the newsletter sign-up on langflow.org is IBM’s. In the February 2025 post, co-founder Rodrigo Nader wrote of “tens of thousands of daily active users”; IBM’s DataStax page says “tens of thousands of developers” use it. Those are vendor figures. The independent ones are counts: stars measure attention, Docker pulls count downloads including every automated redeploy, and PyPI figures cover the langflow package only, not langflow-base.
| When | What happened | Source |
|---|---|---|
| 8 Feb 2023 | GitHub repository created | GitHub |
| 4 Apr 2024 | DataStax acquires Langflow; the founder promises it stays free and open source | Hacker News |
| 25 Feb 2025 | IBM plans to acquire DataStax, Langflow’s parent | Langflow blog |
| 5 May 2025 | CISA lists CVE-2025-3248, unauthenticated code execution, as exploited | CISA |
| 9 Apr 2026 | Hosted DataStax Langflow removed from Astra | DataStax release notes |
| 2 Jul 2026 | IBM bulletin: auto-login flaw lets anyone get a superuser token (CVE-2026-9198) | IBM Support |
| 22 Oct 2026 | 1.13.0: the Python package now requires sign-in by default (Docker images since 1.10.2); audit logs, connections | GitHub, Langflow blog |
A busy, uneven tracker. In the 30 days to 22 Oct 2026, 308 pull requests were merged and 75 issues were opened, 32 of which were already closed; 206 issues and 1,014 pull requests are open. The release pace (35 stable releases in 294 days, one every 8.4 days) is good news for fixes and hard work for anyone who has to keep a server current.
langflow package (8 Apr to 22 Oct 2026, mirrors excluded), read 23 Oct 2026.Downloads are falling for the main package. Monthly PyPI downloads of langflow held between 81,752 and 88,543 from May to July 2026, then dropped to 58,492 in August and 39,546 in September. Part of this may be a split rather than a loss: since 1.12 (1 Sep) langflow-base is itself a runnable app, and in the 30 days to 22 Oct it was downloaded 34,816 times against 37,742 for langflow and 32,879 for the lfx runtime. Docker pulls give no monthly history; the image list on Docker Hub holds 1,450 tags, and the 1.13.0 image is about 785 MB.
No star rating exists, and the written opinion is thin: praise for prototyping speed, complaints about bugs and production readiness.
Trustpilot has no page for langflow.org, and no G2 or Capterra score is cited here. The vendor’s pages carry chosen testimonials (BetterUp, WinWeb and Athena Intelligence on the home page), which are not independent. What remains is Hacker News and the GitHub tracker.
How big is this evidence?
trustpilot.com/review/langflow.org
none above 12 points
mention Langflow; about 6 give a view on using it
opened 23 Sep to 22 Oct 2026; 32 closed
Small. A Hacker News search on 23 Oct 2026 returns 13 stories since 1 Jan 2025 that mention Langflow and 42 comments; most comments are passing mentions in lists of tools, and eleven are the same job-seeker post. The largest Langflow thread is still the April 2024 acquisition announcement (107 points, 24 comments). Read the cards below as individual voices, not a survey.
Calls Langflow AI native but “doesn’t feel production ready”, with random bugs, yet still uses it over n8n to prototype LLM pipelines quickly.
Suggests anyone in tech download Langflow, pick a small model in Ollama, run a template flow and read its prompt setup to see how LLM apps are built.
Sees a definite use in putting many different flows into one common format, as ComfyUI or a shader graph does for images.
Found Langflow “more painful than a wisdom tooth extraction” to use, adding that this was in early 2025.
On the Flowise shutdown thread: Flowise lacked many features that n8n and Langflow offered, so the loss is limited.
Replying to the founder’s promise that Langflow will “forever be free, open-source, and agnostic”: Terraform and Elasticsearch show that such promises depend on who owns the code.
What the tracker shows
The most-reacted open issue (1864, 66 reactions) has asked since May 2024 for roles, shared flows and access control for teams; 1.13 adds a superuser API and CLI for users, teams and roles, so part of that is now arriving. Two current issues bear on trust. In issue 15709 (opened 12 Oct 2026), a researcher says a private security report sent on 12 Sep got one reply on 18 Sep; the reporter followed up on 24 Sep and had no further update a month after submitting; a maintainer passed it to the team that handles HackerOne reports, and on 21 Oct the reporter was still waiting. Issue 15961, opened and closed on 23 Oct, points out that the HackerOne link in SECURITY.md goes to IBM’s programme. One April 2026 comment (47837534) alleges that IBM bought DataStax on “fake stars”; it offers no evidence, and we treat it as an unsupported claim.
For a tool that will hold your model keys and run code, the lack of independent ratings is a gap. Pilot it on a machine with no secrets, read the open issues for the components you need, and if you buy IBM Elite Support, ask for references.
The software is free; the hosted cloud is gone; IBM sells support and an enterprise agent platform, with no Langflow price on either page.
Self-hosted
MIT license, Python package or Docker image
- All features in the docs
- Your server, your keys
- Community support
Langflow Desktop
Mac (macOS 13+) or Windows
- Download behind a contact form
- No Shareable Playground or Voice Mode
- Local use
Elite Support
Subscription support for your own OSS deployment
- Help from the team that wrote most of the code, per the docs
- No public price
watsonx Orchestrate
Essentials, “starting at”, indicative
- Hosts agents; Langflow flows become its tools
- Not a Langflow host
Langflow docs and langflow.org/desktop; IBM’s Langflow and watsonx Orchestrate pricing pages, 23 Oct 2026. IBM marks the Orchestrate price as indicative, varying by country and excluding taxes. langflow.org has no pricing page.
The cloud that is not there
On 9 Apr 2026 DataStax’s release notes recorded: “Removed DataStax Langflow from Astra. As an alternative, you can use Langflow OSS.” The old DataStax Langflow docs address now leads to that note. Two other vendor pages have not caught up. The langflow.org home page still says “Use a free, enterprise-grade cloud to deploy your app” and “Deploy yourself or sign up for a free cloud account”, but its “Get Started for Free” button leads to the Desktop download form and its Sign Up control goes nowhere. IBM’s Langflow page says you can “publish to Langflow Cloud or watsonx Orchestrate”. We found no current Langflow Cloud sign-up page or price on any IBM or Langflow page. Trust the release note.
License and data: short and plain
The LICENSE file is the standard MIT text (“Copyright (c) 2024 Langflow”): commercial use, modification, hosting for clients and white-labelling are all allowed, with no conditions of the kind Dify’s modified license adds. Two data points to know. Telemetry is on unless you set DO_NOT_TRACK=True; per the docs it sends installation-scoped and pseudonymous usage events through Segment and leaves out free-form error messages. And the Desktop download form asks for your name, email, country and company, with a checkbox to let IBM use your contact details for marketing under the IBM Privacy Statement.
Not an affiliate link. It opens Langflow’s official docs.
Three workloads: the server is cheap, the model choice is what moves the bill, and upkeep is the hidden line.
Prices are from DigitalOcean and OpenAI on 23 Oct 2026. Team sizes, run counts and the size of one agent run (8,000 input and 800 output tokens across several model calls) are invented. At OpenAI’s standard rates, one such run costs $0.0012 on gpt-6-luna ($0.10 and $0.50 per million tokens: 8,000 × $0.10 / 1M + 800 × $0.50 / 1M = $0.0008 + $0.0004) and $0.024 on gpt-6.1-sol ($2 and $10: $0.016 + $0.008).
A. One person on a laptop
Langflow Desktop or the Python package, $0. The docs’ minimum is a dual-core CPU and 2 GB of RAM. 1,000 runs a month cost 1,000 × $0.024 = $24.00 on gpt-6.1-sol or $1.20 on gpt-6-luna, or nothing beyond electricity with a local model.
B. Five people, one internal server, 5,000 runs a month
The docs recommend a multi-core CPU and at least 4 GB of RAM; a DigitalOcean Basic droplet with 4 GiB and 2 vCPUs is $24.00 a month, and daily backups add 30% ($7.20): server $31.20. The default SQLite database is meant for one host and one worker, which fits here. Models: 5,000 × $0.024 = $120.00 on gpt-6.1-sol, so $151.20 a month, or 5,000 × $0.0012 = $6.00 on gpt-6-luna, so $37.20.
C. A production API at the documented minimums, 50,000 runs a month
The Kubernetes best-practices page asks for a backend-only runtime with at least 2 GiB and 1 CPU per instance and 3 replicas, an external PostgreSQL with pgvector (SQLite fails its production check), and describes a separate editor deployment for builders. Priced on DigitalOcean: three 2 GiB, 1 vCPU droplets at $12 ($36.00), managed PostgreSQL with 4 GiB and 2 vCPUs ($60.90; its vector extension is supported), a load balancer from $12.00 and a 4 GiB editor droplet ($24.00): infrastructure $132.90, before a Redis cache, a database standby or extra backups. Models: $60.00 on gpt-6-luna ($192.90 a month) or $1,200.00 on gpt-6.1-sol ($1,332.90).
| Example | Server | Luna | Sol |
|---|---|---|---|
| A. Laptop, 1,000 runs | $0 | $1.20 | $24.00 |
| B. Team server, 5,000 runs | $31.20 | $37.20 | $151.20 |
| C. Production, 50,000 runs | $132.90 | $192.90 | $1,332.90 |
Langflow shipped 35 stable releases between 1 Jan and 22 Oct 2026, about 43 a year at that pace. If each upgrade takes half an hour (test the new version in a separate environment, as the release notes recommend, then switch) at $75 an hour, that is 43 × 0.5 h = 21.5 hours, or $1,612.50 a year, about $134.38 a month: more than the server in example B. You will not take every release, but on an exposed server you cannot skip the security ones, and there is no managed tier to hand this to.
For scale, not like-for-like: on 23 Oct 2026 Dify’s Team cloud plan is $159 a month per workspace with 10,000 message credits, n8n’s Pro plan is 50 euros a month billed annually for 10,000 executions, and IBM watsonx Orchestrate Essentials starts at $609.50 a month. Each buys hosting that Langflow no longer sells.
Match your situation to one line.
uv pip install langflow on your laptop, with a local model or a cheap key. This is where it shines.LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true or custom components off, and a microVM sandbox. Otherwise choose a tool whose users cannot author code.Agents with tools you can see, a Playground that shows each tool call, and Python under every box.
The Agent component takes a model, instructions and any number of tools; many components can switch to Tool Mode and become a tool the agent may call. In the Playground you see which tool the agent called, with what input and what came back, and how long each step took, which is the main reason people reach for a canvas in the first place. The 1.13 docs have pages for 80 provider and integration bundles, from OpenAI, Anthropic and Ollama to vector stores (pgvector, Qdrant, Weaviate, Milvus, Pinecone) and Google Workspace, Microsoft 365 and Slack connections.
The flip side of “Python under every box” is where this review spends most of its words: the code you, your colleagues or an agent put into a component runs on the server, with the server’s access.
Build on a private machine, serve from a locked-down one.
An illustrative sequence built from the documented features and the docs’ own deployment advice, not a record of a JAVIS build.
Every flow is an API endpoint and, by default, an MCP tool.
The API access pane gives ready code in Python, JavaScript and cURL for /api/v1/run/<flow id>; calls need a Langflow API key. Langflow is also an MCP server: when you create a project, Langflow adds it to its MCP configuration and serves the project’s flows as tools over streamable HTTP, with SSE as a fallback; with sign-in on, it generates an API key for that project. It is an MCP client too, so an agent can call other MCP servers. As of 1.10 a flow can also be packaged as a tool for an agent in IBM watsonx Orchestrate, behind a feature flag (LANGFLOW_FEATURE_WXO_DEPLOYMENTS=true); that does not host the Langflow editor.
Because new projects join the MCP server automatically, every flow you build may be callable by any MCP client that holds the project’s key. Set LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS=false if you want to opt flows in one by one, and review the tool list before connecting a client such as Claude; see our guide to Claude MCP connectors.
37 published advisories, 17 critical, and six flaws that attackers have used against real servers.
GitHub lists 37 security advisories for langflow-ai/langflow on 23 Oct 2026: 17 critical, 13 high, 6 moderate and 1 low. 33 were published in 2026, 16 of them critical, including several that let someone without an account run code on the server. The highest fixed version named by any critical advisory is 1.10.3, and by any advisory 1.12.0.
Exploited in the wild: CISA’s list
CISA’s Known Exploited Vulnerabilities catalogue, version 2026.10.21, has six Langflow entries. Being on it means CISA has evidence of real attacks, not just a bug report.
| Added | Flaw | Fixed in |
|---|---|---|
| 5 May 2025 | CVE-2025-3248: missing authentication on the code validation endpoint; known ransomware use | 1.3.0 |
| 25 Mar 2026 | CVE-2026-33017: public flow builds without sign-in lead to code execution | 1.9.0 |
| 21 May 2026 | CVE-2025-34291: permissive CORS plus a cross-site refresh cookie lets a web page take over a session | 1.9.3 (CISA note) |
| 7 Jul 2026 | CVE-2026-55255: a signed-in user can run another user’s flow by its ID | 1.9.1 |
| 21 Jul 2026 | CVE-2026-0770: code execution through functionality from an untrusted source | 1.9.0 (CISA note) |
| 4 Aug 2026 | CVE-2026-9198: auto-login hands a superuser token to any caller, then runs code (CVSS 9.8, per IBM) | 1.10.1 |
The auto-login flaw is the one to understand. IBM’s bulletin of 2 Jul 2026 says Langflow OSS 1.0.0 through 1.10.0 let an unauthenticated caller chain /api/v1/auto_login, which “mints SUPERUSER tokens to any network caller”, with the code validation endpoint “to achieve full RCE on default Langflow deployments”. The fix is 1.10.1; the bulletin lists no workaround. Whether a fresh install asked for a password depended on how you installed it. The official Docker image’s Dockerfile has set LANGFLOW_AUTO_LOGIN=false since tag v1.10.2 (7 Jul 2026; the Docker docs say “as of Langflow 1.11.x”), while the v1.10.0 and v1.10.1 Dockerfiles did not set it. The Python package’s own default stayed on (default=True in its settings code) through 1.12.8 and switched off in 1.13.0 on 22 Oct 2026. So pip installs are the ones that change most with 1.13.
What an attack looked like. Sysdig’s threat research team described on 1 Jul 2026 an attacker it calls JADEPUFFER that entered through an internet-facing Langflow instance via CVE-2025-3248. Its tooling swept the host for model API keys (OpenAI, Anthropic, DeepSeek, Gemini and others) and cloud credentials, dumped Langflow’s own Postgres database with its stored keys and user records, then scanned the internal network and moved on to a production database for extortion. Sysdig calls it the first documented case of ransomware driven end to end by an LLM. That is a vendor’s research claim, but the path it describes is the one Langflow’s own docs warn about.
What the docs say you are responsible for
The security page is unusually frank: “Flow visibility and user access controls are designed for usability, not security enforcement. Users can access underlying database connections and system resources directly.” If you offer Langflow to third parties, it says, “you must assume that any code executed by Langflow could be potentially malicious” and isolate tenants at the process, disk, network and database level yourself. The custom-components page adds that in multi-user mode “every regular user effectively has code execution on the host unless you restrict it”. The default code sandbox is none, which runs code “in the Langflow process. No isolation.”; the alternative, exec-sandbox, needs a hypervisor (KVM or HVF) on the host.
LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true (or turn custom components off) and consider the exec-sandbox backend for the Python Interpreter.A JAVIS checklist built from the Langflow security, custom-components and sandbox docs, the GitHub advisories and IBM bulletin 7278927, as of 23 Oct 2026.
Five things that go wrong in the first months, in the order you are likely to meet them.
LANGFLOW_AUTO_LOGIN=false (official Docker images have set it since 1.10.2). The blog says to set a superuser password before you start it “or you may not be able to sign in”, and the install guide warns: “Don’t delete or reinstall Langflow to regain access, because that can permanently remove your flows.” Read the recovery page before you upgrade. One open issue (15857, 19 Oct) reports the MCP starter project failing when auto-login is left on. Earlier sign-in bugs show the path is still settling: issue 14884 (closed 1 Sep 2026) found that with auto-login off, a failed superuser creation was logged only at debug level, “leaving a deployment with no working login and no error”, and issue 14536 (closed 14 Aug) found that upgrading to 1.11.1 to 1.11.3 broke MCP server registration and left one unused API key per project on every start./app/data/.cache and Redis; the production checklist refuses SQLite.Sources: the 1.13 blog post and release notes (22 Oct 2026), the install, production and custom-components docs, CISA’s catalogue and GitHub issue 15857, as of 23 Oct 2026.
An upgrade checklist for pip and Docker installs, from the 1.13 docs.
Most Langflow trouble starts at an upgrade, and the steps differ by install type. Every setting below comes from the 1.13 docs pages on authentication, Docker, Knowledge storage and the release notes, as of 23 Oct 2026. The version to land on today is 1.13.0, or 1.12.8 if you stay on the 1.12 line; anything before 1.10.3 is below the fixed version of at least one critical advisory.
- Install the new version in a new virtual environment first and import your flows there, as the release notes recommend; pin it, for example
uv pip install langflow==1.13.0. - This is the install whose sign-in default changes in 1.13. Prepare the account before upgrading (steps below).
- If you pin
langflow-base~=0.12, you stay on the old package line; the runnablelangflow-basestarts at 1.12.0. - Python 3.10 to 3.14. The new local storage needs a
sqlite-vecwheel, which Python 3.14 on Windows ARM64 does not have.
- Check where data lives first. Unless you set
LANGFLOW_DATABASE_URLorLANGFLOW_SAVE_DB_IN_CONFIG_DIR=true, the SQLite database is inside the container, and withoutLANGFLOW_CONFIG_DIRon a mounted path so are the secret key and uploads: “Removing or recreating that container deletes this data, even if a volume is mounted.” Move it to a volume before upgrading. - Pin a tag (
langflowai/langflow:1.13.0, as the docs’ Compose example does) rather thanlatest. - The official image already sets
LANGFLOW_AUTO_LOGIN=false(since 1.10.2); DEV and CDK images only from 1.13.
~/.langflow/knowledge_bases). Export projects too. The database written during the 1.13 copy “cannot be used to return to 1.12”.PATCH /api/v1/users/{user_id} from a signed-in session or API key. Then set LANGFLOW_AUTO_LOGIN=false, LANGFLOW_SUPERUSER to that same username and LANGFLOW_SUPERUSER_PASSWORD. Do not delete the account, database or key: a new superuser does not inherit the old one’s flows.LANGFLOW_AUTO_LOGIN=true in your environment or .env still wins over the new default. Turning auto-login off “does not revoke previously issued sessions or API keys”, so rotate those.fuse.grpcfuse bind mount), and set LANGFLOW_KNOWLEDGE_BASE_AUTO_MIGRATE=false if several hosts share the bases or you are moving to pgvector or OpenSearch. Chroma Cloud does not reconnect.A JAVIS checklist assembled from the Langflow docs pages API keys and authentication, Deploy Langflow on Docker, Upgrade Knowledge and Memory storage, Install Langflow and the release notes, plus the official Dockerfiles at tags v1.10.0 to v1.13.0, as of 23 Oct 2026. Not a tested procedure.
Builders who think in Python and want to see their agents work.
- Developers prototyping agents, RAG and MCP tools
- Teams that want an MIT license with no hosting or branding conditions
- Anyone who already runs and patches containers
- Teachers and learners who want to see each step of an agent
- Buyers who want a hosted, managed product
- Platforms where untrusted users build flows
- Teams without someone to track weekly releases
- Non-technical users automating business apps (n8n fits better)
Nine things to weigh before you rely on it.
DataStax Langflow removed 9 Apr 2026; you run the servers.
langflow.org and IBM still advertise a cloud that DataStax removed.
No isolation between users; the default sandbox is none.
6 CISA-listed CVEs; 17 critical advisories in all.
35 stable releases in 2026 to 22 Oct; breaking changes in 1.13.
One researcher’s Sep 12 report got one reply (Sep 18), then no update for a month (issue 15709).
Usage events go to Segment unless you set DO_NOT_TRACK=True.
IBM Elite Support has no public price.
No Trustpilot profile; few recent first-hand opinions.
And one more: JAVIS did not install or run Langflow for this review.
Priced on the same day from each vendor’s page; the units differ, so the plans are not like-for-like.
| Product | Price, 23 Oct 2026 | JAVIS review |
|---|---|---|
| Langflow | $0, MIT; self-hosted only | This article |
| Dify | Cloud $59 or $159 a month per workspace; self-host free under a modified Apache 2.0 license | Dify review |
| n8n | Starter 20 euros and Pro 50 euros a month billed annually (2.5k and 10k executions); Business 667 euros, self-hosted only | n8n review |
| RAGFlow | Free; Starter $29 and Pro $129 a month, beside crossed-out $59 and $259 | RAGFlow review |
| LangChain | Framework free; LangSmith Developer $0 (1 seat), Plus $39 per seat a month | LangChain review |
| Flowise | Wound down: code freeze 29 Jul 2026, archived 10 Aug, end of life 31 Aug | Not reviewed |
How they differ. Dify is the closest canvas rival and the one to pick if you want someone else to host it; its license, unlike Langflow’s, restricts multi-tenant hosting and logo removal (see the Dify review). n8n is an automation tool first, built around connecting business apps; Langflow’s own video below says as much. RAGFlow is built around parsing complex documents for retrieval. LangChain and LangGraph are code, not a canvas; Langflow began as a UI for LangChain.
Flowise, the other popular open-source canvas, shut down in 2026, citing developers moving to coding agents: “The typical rigid workflow low code approach quickly hits the limit when it comes to complexity.” Langflow is in a stronger position, with IBM behind it and a release every eight days, but its hosted service has already gone once. Keep your flows exported as JSON in your own repository.
This review has no affiliate links, and neither Langflow nor IBM saw it.
JAVIS has no approved Langflow affiliate link, so every Langflow link in this article goes straight to langflow.org, its docs or GitHub, with no tracking parameters. Langflow itself is free, so there is nothing to sell.
Hands-on status: JAVIS has not installed Langflow, downloaded Desktop or built a flow. Facts come from Langflow’s site, docs, blog, license, release notes and GitHub records; IBM and DataStax pages; CISA’s catalogue; Sysdig’s published research; Docker Hub; pypistats.org; Hacker News; and the DigitalOcean, OpenAI, Dify, n8n, RAGFlow, LangChain and IBM price pages, as of 23 Oct 2026. Vendor screenshots are labelled as such.
Start on a laptop with a test key and no production secrets.
Open langflow.orgCheck your version against the advisories.
Open the advisoriesBuilding agents or AI workflows? These reviews cover the nearest ground.
Each card opens a published JAVIS review.
Questions people ask before building
Is Langflow free in October 2026?
Yes. Langflow is MIT-licensed and free to install as a Python package, a Docker image or Langflow Desktop. You pay for your server and model API keys. IBM sells Elite Support with no public price.
Is there a Langflow cloud?
Not that you can sign up for. DataStax removed its hosted Langflow from Astra on 9 Apr 2026 and pointed users to Langflow OSS, even though langflow.org and IBM’s page still mention a cloud.
How much does self-hosting cost?
About $31.20 a month for a 4 GiB DigitalOcean droplet with daily backups for a small internal team, or about $132.90 for the documented production minimum with three runtime replicas, managed PostgreSQL, a load balancer and an editor instance, plus model costs and upkeep time.
Is Langflow secure?
It can be run safely, but it is a code execution platform by design. GitHub lists 37 advisories (17 critical) and CISA lists six Langflow flaws as exploited. Stay on a current release (1.12.8 or 1.13.0 on 23 Oct 2026), keep it off the public internet and restrict custom code.
Who owns Langflow?
IBM, through DataStax, which bought Langflow in April 2024; IBM announced its plan to acquire DataStax in February 2025.
Can I use it commercially or host it for clients?
The MIT license allows it. The security docs say you must then isolate tenants yourself at the process, disk, network and database level, because Langflow does not.
What changed in 1.13?
The Python package now requires sign-in by default, as official Docker images have since 1.10.2; local Knowledge and Memory move from Chroma to SQLite, and audit logs, reusable connections, concurrent editing checks and an admin API arrived (22 Oct 2026).
How do I upgrade to 1.13 without losing access?
Back up the database, configuration directory and knowledge-base folder, give the existing superuser a known password, then set LANGFLOW_AUTO_LOGIN=false, LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD before starting 1.13. Docker users should first make sure the database is not stored inside the container. See the upgrade checklist.
Is Langflow an affiliate product here?
No. This review has no affiliate links.
Where this came from, and when.
Product and pricing: langflow.org home, desktop and blog (1.13 post of 22 Oct 2026; IBM acquisition post of 25 Feb 2025); docs.langflow.org pages on installation, security, custom components, sandbox backends, the Python Interpreter, production best practices and architecture, telemetry, MCP server, watsonx Orchestrate deployment, IBM Elite Support and release notes; the LICENSE and SECURITY.md files; IBM’s Langflow, DataStax and watsonx Orchestrate pricing pages; DataStax’s Astra DB Serverless release notes; all 23 Oct 2026.
Server and model prices: DigitalOcean Droplet, Managed Database and Load Balancer pricing and its PostgreSQL extensions list; OpenAI API pricing (standard, short context); 23 Oct 2026. All sums are shown in the sections above.
Security: the 37 GitHub security advisories for langflow-ai/langflow with their patched versions; CISA’s Known Exploited Vulnerabilities catalogue version 2026.10.21 (six Langflow entries); IBM security bulletin 7278927 (2 Jul 2026, modified 17 Aug 2026); Sysdig’s JADEPUFFER post of 1 Jul 2026.
Independent evidence: GitHub repository data (155,958 stars, 10,241 forks, 206 open issues, 1,014 open pull requests, 35 stable releases in 2026), issue counts for 23 Sep to 22 Oct 2026 and issues 1864, 15709, 15857 and 15961; Docker Hub pulls for langflowai/langflow (4,366,451) and its tag list (1,450 tags); pypistats.org downloads for the langflow package (37,742 in the last month; monthly totals 8 Apr to 22 Oct 2026, mirrors excluded) and for langflow-base (34,816) and lfx (32,879); the official Dockerfiles at tags v1.9.3, v1.10.0, v1.10.1, v1.10.2, v1.11.0, v1.12.0, v1.12.8 and v1.13.0, and the auth settings code at v1.12.8 and v1.13.0; issues 14536 and 14884; Trustpilot (no profile for langflow.org); Hacker News stories 39933342 (4 Apr 2024), 43573268 (3 Apr 2025), 48776412 (3 Jul 2026) and 49176920 (5 Aug 2026), and comments 39934460 (4 Apr 2024), 44305378 (18 Jun 2025), 44468662 (4 Jul 2025), 44593114 (17 Jul 2025), 45451912 (2 Oct 2025), 47837534 (20 Apr 2026) and 49178292 (5 Aug 2026); a Hacker News search for items since 1 Jan 2025, run on 23 Oct 2026.
Competitors: dify.ai/pricing, n8n.io/pricing, ragflow.io, langchain.com/pricing and flowiseai.com/sunset, 23 Oct 2026.
Images: eleven screenshots of public pages taken on 23 Oct 2026 (langflow.org home, its cloud section and desktop form, the GitHub repository and advisories, two Langflow docs pages, the DataStax release notes, the IBM Langflow page, Dify pricing and the Flowise sunset page); six vendor screenshots and diagrams from the Langflow docs, labelled as such; two videos from Langflow’s official YouTube channel; JAVIS charts and the architecture diagram computed from the cited figures. Related cards use JAVIS’s own featured images.
Store ratings: none included; Langflow has no mobile app listing.
JAVIS Fit Score (64/100): five criteria scored out of 20. Price clarity 16: the software is plainly free under MIT, but the vendor pages still advertise a cloud that no longer exists and support has no price. Capability breadth 17: agents with visible tool calls, 80 documented bundles, API, MCP server and client, Python extensibility. Independent evidence 10: strong repository and download data, but no Trustpilot profile and few recent first-hand opinions. Security and data control 6: full self-hosting and an MIT license, offset by 17 critical advisories, six exploited flaws, no isolation between users and telemetry on by default. Cost control and fit 15: free software and cheap servers, offset by upkeep time and no managed tier. It is judgment, not a measurement.
What this review does not cover: build quality, answer accuracy, performance under load, a technical security review of current versions, Langflow Desktop itself, IBM Elite Support terms and every one of the 80 bundles.
