Two Langflow API endpoints can be chained by anyone on the network to mint a superuser token and then execute arbitrary code, with no login required.