By MV2 of Munim, Inc., with AI agents. Checked on 2 November 2026 against Langflow 1.13.0's source code, its pull requests and its documentation; each claim links its source. For your own servers only.
If Langflow 1.13 or newer stops at startup with this message, it is working as designed:
Username and password must be set. Set LANGFLOW_SUPERUSER_PASSWORD before starting Langflow. If you are upgrading an existing auto-login installation, see https://docs.langflow.org/next/api-keys-and-authentication#upgrade-from-auto-login
Why: from 1.13.0 (22 October 2026), Langflow's official release packages default LANGFLOW_AUTO_LOGIN to False, like its Docker images. Up to 1.12.8 the setting defaulted to True, which signed every visitor in as an administrator. Compare the setting in 1.12.8 with the setting in 1.13.0; the change is pull request #14993. With auto-login off, Langflow needs a real administrator password, and the startup code raises this error when none is set.
Use a long random password. Langflow refuses its old default password with "LANGFLOW_SUPERUSER_PASSWORD cannot use the legacy default password" (that old value is langflow, per Langflow's settings constants). The user name is langflow unless you set LANGFLOW_SUPERUSER.
read -rsp "Langflow administrator password: " LANGFLOW_SUPERUSER_PASSWORD; echo export LANGFLOW_SUPERUSER_PASSWORD langflow run
With Docker, -e LANGFLOW_SUPERUSER_PASSWORD with no value passes the variable through from your shell, so the password is not written into the command or your shell history:
docker run -p 127.0.0.1:7860:7860 -e LANGFLOW_SUPERUSER_PASSWORD langflowai/langflow:1.13.0
In a .env or Compose file, set LANGFLOW_SUPERUSER_PASSWORD there and keep the file out of Git. Then sign in at http://localhost:7860 with the user name and that password.
If your old Langflow signed you in automatically, your flows belong to that auto-login account, and Langflow generated its password without showing it to you. Langflow's upgrade guide and pull request #15789 describe what goes wrong: after an unprepared upgrade your flows are still in the database, but you may not be able to sign in to the account that owns them.
LANGFLOW_SECRET_KEY to get back in. That can remove your flows or make stored credentials unreadable.LANGFLOW_SUPERUSER to a new name creates a different account; the docs say it does not take over the old account's flows.LANGFLOW_AUTO_LOGIN=false, LANGFLOW_SUPERUSER to that account's user name and LANGFLOW_SUPERUSER_PASSWORD to its password, and upgrade with the same database and config directory. The upgrade guide has the details.Already upgraded and can't sign in? Langflow's documented recovery is to start once more with LANGFLOW_AUTO_LOGIN=true, set a password on that same account through the API, then turn auto-login off again. Back up the database and config directory first. While auto-login is on, anyone who can reach port 7860 is signed in as the administrator, so make sure only this machine can reach it for those few minutes (for Docker, -p 127.0.0.1:7860:7860).
# 1. Get a token: copy "access_token" from the reply
curl -s http://localhost:7860/api/v1/auto_login
# 2. Get the account's id: copy "id" from the reply
curl -s http://localhost:7860/api/v1/users/whoami -H "Authorization: Bearer ACCESS_TOKEN"
# 3. Type a new password (no " or \ characters; it is not saved in your history) and set it
read -rs NEW_PASSWORD
curl -s -X PATCH http://localhost:7860/api/v1/users/USER_ID \
-H "Authorization: Bearer ACCESS_TOKEN" -H "Content-Type: application/json" \
-d "{\"password\": \"$NEW_PASSWORD\"}"
Then stop Langflow, remove LANGFLOW_AUTO_LOGIN=true (or set it to false), set LANGFLOW_SUPERUSER_PASSWORD to the same password (and LANGFLOW_SUPERUSER if the user name is not langflow), start it and sign in. Turning auto-login off does not cancel sessions or API keys that were already issued, so review the API keys in Langflow's settings afterwards.
You may also see a startup warning that begins "AUTO_LOGIN is off, so the default superuser 'langflow' was deactivated". It means the old auto-login account still owns data, so Langflow switched it off and kept it rather than deleting it. The warning itself names the way back: "Another superuser can reactivate it and set a password" through PATCH /api/v1/users/<id>. Your flows are still there.
Only on a laptop that nobody else can reach. With LANGFLOW_AUTO_LOGIN=true, every visitor to port 7860 is an administrator who can run Python on the server. For a shared or internet-facing Langflow, use a password and the rest of the Langflow hardening checklist: CORS, the secret key, LANGFLOW_SSRF_ALLOWED_HOSTS, code execution and keeping port 7860 private.
1.13.0 (22 October 2026) is the newest Langflow release when checked on 2 November 2026. By their published ranges, it is clear of all 35 security advisories Langflow has published for the langflow package.
MV2's Local AI Health Check reviews a self-hosted AI setup (Langflow, Ollama, Open WebUI, n8n and others): you run the free, open-source checker and send its output, and you get a written report with the fixes in order. $49 for one machine or $199 for up to 5. Questions: mv2@munimtech.com.