Langflow: 4 Vulnerabilities Disclosed, 2 Critical Flaws Allow Unauthenticated Code Execution

IBM published a security bulletin on October 28, 2026, updated October 29, disclosing four vulnerabilities in Langflow OSS, an open-source tool for building AI agents and workflows, two of them rated CVSS 9.8 and exploitable without any account, with the only fixed release being version 1.13.0, published October 22, 2026. According to The Hacker News, which reported the disclosure on November 2, 2026, the flaws affect every Langflow release from 1.0.0 through 1.12.8, and IBM offers no workaround for deployments that cannot upgrade.

What was the specific vulnerability?

The two critical flaws are CVE-2026-93680, an authentication bypass described as improper authentication, and CVE-2026-110186, an arbitrary code execution flaw described as improper control of code generation, both rated CVSS 9.8 and both reachable without credentials. According to IBM's security bulletin, one flaw amounts to "unauthenticated remote code execution exploitable through model context protocol tool enumeration": Langflow exposes its flows as MCP tools to AI applications, and an attacker can reach the MCP endpoint with no credentials.

Two further flaws require some access. CVE-2026-110193, rated CVSS 8.8, requires a low-privileged account and lets an attacker make the "Agentic Assistant" generate or submit component code that runs operating system commands on the server. CVE-2026-110192, rated CVSS 6.5, exposes API credentials through insufficiently protected credentials storage.

A configuration detail compounds the risk. LANGFLOW_AUTO_LOGIN is enabled by default in Langflow 1.12.8, and when enabled, Langflow logs users in as superusers without prompting. The setting's code description warns it "bypasses authentication and should only be used in development environments." IBM's bulletin also flags "an incomplete remediation of an auto-login security control," though it does not state whether servers running with auto-login disabled remain vulnerable.

How was the incident detected?

The flaws were found and disclosed by IBM, which receives Langflow's vulnerability reports, in a security bulletin first published October 28, 2026 and updated October 29. The Hacker News covered the disclosure on November 2, 2026, in a report by Swati Khandelwal.

Public exploitation tooling already exists. A module in the public Metasploit Framework, hosted in the rapid7/metasploit-framework repository, cites CVE-2026-93680. According to the module's documentation, it connects to a Langflow server's MCP endpoint without credentials, starts a session, and lists the tools the server offers; it does not run code. Its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM's, and notes the module was tested on Langflow 1.8.4 with automatic login enabled.

What is the current impact?

Anyone running Langflow OSS 1.0.0 through 1.12.8 is exposed, and version 1.12.8, released the same day as the fix, still carries the flaws. As of November 2, PyPI lists no later 1.12 release, making 1.13.0 the only patched version. Unauthenticated attackers can bypass authentication and execute arbitrary code on the server; authenticated low-privileged users can achieve OS command execution through the Agentic Assistant; and API credentials can be disclosed.

Neither of the two critical flaws appears in CISA's Known Exploited Vulnerabilities catalog as of the October 30 update, and no confirmed in-the-wild exploitation is reported in the sources read. Six other Langflow flaws are already listed in the KEV catalog, the most recent being CVE-2026-9198, added in August. The disclosure is also broader than the four flaws in the main bulletin: on October 29, IBM published CVE records for 29 additional Langflow flaws, fixed in versions 1.12.4 and 1.12.5, including CVE-2026-104339, another unauthenticated arbitrary code execution flaw rated CVSS 9.8. None of the 33 records lists 1.13.0 as affected.

What are the next steps?

The remediation is to upgrade to Langflow 1.13.0, either via pip install --upgrade "langflow==1.13.0" or the Docker image langflowai/langflow:1.13.0. Langflow 1.13 turns automatic login off by default, closing the default-dangerous configuration present in 1.12.8.

Because the upgrade changes how sign-in works, operators should follow Langflow's upgrade guidance: back up the database, the secret key and uploaded files, and prepare the auto-login account for password sign-in. The documentation warns users not to delete and reinstall Langflow to regain access, since this can permanently remove flows. IBM offers no workaround for organizations that cannot upgrade immediately, so isolating Langflow servers from untrusted networks is the only mitigation the sources describe.

By the numbers

Source snapshot