Critical Langflow flaws expose servers to unauthenticated attacks

Two critical flaws in Langflow, the open‑source tool for building AI agents and workflows, could allow unauthenticated remote attackers to bypass authentication or execute arbitrary code on Langflow servers.

IBM’s security bulletin details four CVEs: CVE-2026-93680 (9.8, authentication bypass), CVE-2026-110186 (9.8, remote code execution via improper control of code generation), CVE-2026-110193 (8.8, enabling a low‑privileged account to have an agent generate component code that can run OS commands), and CVE-2026-110192 (6.5, exposure of credentials).

IBM notes that one flaw involves unauthenticated RCE exploitable through the Model Context Protocol (MCP), which lets Langflow offer its flows as tools to AI apps that support MCP. A public Metasploit module references CVE-2026-93680 as an authentication bypass, and tests cited by IBM mention Langflow 1.5.0–1.11.4 as affected, though IBM’s bulletin lists a broader set of versions.

Langflow versions 1.0.0 through 1.12.8 are affected, with the fixed release being 1.13.0. Version 1.13.0 disables automatic login by default, addressing at least part of the risk, while upgrading requires careful steps: back up data, adjust existing accounts to password sign‑in if auto login is enabled, then upgrade via pip or Docker image, and follow the documented recovery steps if sign‑in fails.

IBM’s bulletin notes ongoing remediation considerations and that 1.12.8 remains listed as vulnerable in its notes; separate IBM CVE records published on 29 October mention additional flaws and fixes, with CVE-2026-104339 cited as another potential unauthenticated RCE. The article notes that none of these Langflow flaws are yet in CISA’s Known Exploited Vulnerabilities catalog as of 30 October.