Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week.
Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0.
Neither flaw is in CISA’s Known Exploited Vulnerabilities catalog, as of the catalog’s October 30 update. Six other Langflow flaws are listed there, most recently CVE-2026-9198, which was added in August.
The four Langflow flaws in IBM’s bulletin, first published on October 28 and updated the next day, are:
| CVE | CVSS score (IBM) | Account needed | What IBM says it could allow |
|---|---|---|---|
| CVE-2026-93680 | 9.8 (Critical) | No | Bypassing security restrictions, because of improper authentication |
| CVE-2026-110186 | 9.8 (Critical) | No | Running arbitrary code, because of improper control of code generation |
| CVE-2026-110193 | 8.8 (High) | Yes, a low-privileged account | Making the Agentic Assistant generate or submit component code that runs operating system commands on the server |
| CVE-2026-110192 | 6.5 (Medium) | Yes | Getting sensitive information from insufficiently protected credentials |
One of the flaws is “unauthenticated remote code execution exploitable through model context protocol tool enumeration,” according to IBM. Through the Model Context Protocol (MCP), Langflow can offer its flows as tools to AI apps that support MCP.
A module in the public Metasploit Framework already cites CVE-2026-93680, the authentication bypass. It connects to a Langflow server’s MCP endpoint without credentials, starts a session, and lists the tools the server offers. It does not run code or commands on the server.
Its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM’s.
When automatic login is enabled, Langflow logs users in as superusers without prompting them to sign in. The setting LANGFLOW_AUTO_LOGIN is enabled by default in Langflow 1.12.8. Its code description warns that it “bypasses authentication and should only be used in development environments.”
The module was tested on Langflow 1.8.4 with automatic login turned on. Another of the four flaws is “an incomplete remediation of an auto-login security control,” according to IBM. The bulletin does not say whether servers with automatic login turned off are vulnerable.
Upgrading to 1.13.0
Langflow 1.13.0 came out on October 22. Version 1.12.8, released the same day, still has the flaws, and PyPI lists no later 1.12 release as of November 2. IBM offers no workaround for servers that cannot upgrade yet.
Langflow 1.13 turns automatic login off by default. To upgrade:
- Back up the database, the secret key and uploaded files.
- If the server uses automatic login, prepare the existing account for password sign-in, as Langflow’s upgrade guidance describes.
- Upgrade the Python package with pip install –upgrade “langflow==1.13.0”. For Docker, move to the langflowai/langflow:1.13.0 image and keep the deployment’s persistent data.
- If you cannot sign in after upgrading, follow the recovery steps that the same guidance links to. Do not delete or reinstall Langflow to get access back, because Langflow’s documentation warns this can permanently remove your flows.
On October 29, IBM also published CVE records for 29 other Langflow flaws and named versions 1.12.4 and 1.12.5 as their fixes. One of them, CVE-2026-104339, could also let an attacker with no account run arbitrary code, and IBM rates it 9.8. None of the 33 records, these four included, lists 1.13.0 as affected.
