Follow us on Google News
Two critical vulnerabilities in Langflow could allow remote attackers without an account to bypass authentication or execute arbitrary code on affected servers, according to a security bulletin published by IBM.
Langflow is an open-source platform used to build AI agents and workflows. IBM said every Langflow release from version 1.0.0 through 1.12.8 is affected by the newly disclosed flaws, with version 1.13.0 providing the fix.
The most serious issues are tracked as CVE-2026-93680 and CVE-2026-110186. Both carry a CVSS score of 9.8 and can be exploited without authentication.
Two Critical Flaws Allow Authentication Bypass and Code Execution
CVE-2026-93680 is an improper authentication vulnerability that could allow an attacker to bypass security restrictions without having a valid Langflow account.
CVE-2026-110186 is a separate critical flaw involving improper control of code generation. IBM said the vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected server.
One of the issues was described as unauthenticated remote code execution that could be reached through Model Context Protocol, or MCP, tool enumeration.
Langflow supports MCP as a way of exposing workflows and tools to compatible AI applications. This functionality can allow an external client to discover and interact with tools made available by a Langflow instance.
The vulnerabilities are particularly serious because they affect externally reachable AI infrastructure and do not necessarily require an attacker to obtain account credentials first.
Two Additional Langflow Vulnerabilities Also Disclosed
IBM’s security bulletin also detailed two other vulnerabilities affecting the platform.
CVE-2026-110193 carries a CVSS score of 8.8 and requires a low-privileged account. IBM said it could allow a user to make Langflow’s Agentic Assistant generate or submit component code that executes operating system commands on the server.
Another vulnerability, CVE-2026-110192, is rated 6.5 and could expose sensitive information because credentials were not sufficiently protected.
Together, the four vulnerabilities affect authentication controls, code execution and credential security.
IBM first published its bulletin on October 28 and updated it the following day.
Public Metasploit Module Targets Authentication Bypass
A module targeting CVE-2026-93680 is already available in the public Metasploit Framework.
The module connects to a vulnerable Langflow server’s MCP endpoint without credentials, starts a session and enumerates tools exposed by the server.
It does not itself execute operating system commands or arbitrary code.
The Metasploit module lists Langflow versions 1.5.0 through 1.11.4 as affected, which is narrower than the range identified in IBM’s bulletin.
The existence of a public module nevertheless lowers the technical barrier for security researchers and attackers attempting to test whether exposed Langflow installations are vulnerable to the authentication bypass.
Auto-Login Configuration Adds Security Concern
Langflow’s automatic login functionality is another important part of the security discussion.
When automatic login is enabled, users can be logged in without being prompted for credentials. Earlier Langflow configurations allowed this behaviour through the LANGFLOW_AUTO_LOGIN setting.
The setting was designed primarily for trusted development environments.
Langflow 1.13.0 changes the security posture by turning automatic login off by default for official release packages and Docker images.
Development environments can still enable the feature explicitly.
IBM also described one of the disclosed flaws as an incomplete remediation of an auto-login security control.
The bulletin does not clearly state whether systems with automatic login disabled remain vulnerable to every issue listed in the advisory.
Version 1.13.0 Is the Required Fix
Langflow 1.13.0 was released on October 22 and is the version administrators are being advised to deploy.
Version 1.12.8, released on the same day, still contains the vulnerabilities.
IBM has not provided a workaround for organisations that are unable to upgrade immediately.
Administrators upgrading Python-based deployments can move to version 1.13.0 using the package manager, while Docker users should move to the corresponding 1.13.0 image.
Langflow recommends backing up databases, secret keys and uploaded files before performing the upgrade.
Deployments that previously relied on automatic login may also need to prepare existing accounts for password-based authentication before moving to the new release.
Langflow documentation warns users against deleting or reinstalling the platform as a recovery method because doing so could permanently remove stored flows.
CISA Has Not Listed These Flaws as Exploited
As of CISA’s October 30 Known Exploited Vulnerabilities catalogue update, none of these four newly disclosed Langflow vulnerabilities had been added to the KEV list.
This means there was no confirmed inclusion indicating known exploitation in the wild at that point.
However, Langflow has faced exploitation of other vulnerabilities in the past.
CISA has previously added six Langflow flaws to its KEV catalogue, including CVE-2026-9198 in August.
IBM also disclosed records for 29 additional Langflow vulnerabilities on October 29. Some of those issues were addressed in versions 1.12.4 and 1.12.5.
One of them, CVE-2026-104339, was also rated 9.8 and could allow unauthenticated arbitrary code execution.
None of the 33 vulnerabilities referenced across the newly published records lists Langflow 1.13.0 as affected.
AI Workflow Servers Need Immediate Attention
The disclosure adds to growing concerns about the security of platforms used to build and expose AI agents, especially where they are connected to external tools, APIs and Model Context Protocol services.
A successful compromise of a Langflow server could potentially expose workflows, credentials and connected systems depending on the configuration and permissions of the affected deployment.
Administrators running versions from 1.0.0 through 1.12.8 should therefore upgrade to Langflow 1.13.0, review whether their instances are exposed to the internet and examine authentication settings and MCP endpoints for unnecessary access.
The vulnerabilities show how weaknesses in AI orchestration platforms can move beyond the model layer itself and become traditional server-security risks, including authentication bypass, command execution and exposure of sensitive credentials.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
