Critical Langflow flaws let unauthenticated attackers bypass authentication or run code, IBM says

TLDR

• IBM says Langflow 1.0.0 through 1.12.8 has two critical flaws, each CVSS 9.8, exploitable without an account.²
• The only fix is Langflow 1.13.0, released 22 October; IBM lists no workaround.²⁷
• The Hacker News reports neither flaw is in CISA's KEV catalog as of 30 October.¹

IBM's security bulletin for Langflow OSS, first published on 28 October 2026, lists four flaws.² The Hacker News reports it was updated the next day.¹ CVE-2026-93680 is an improper authentication flaw that could let a remote attacker bypass security restrictions, and CVE-2026-110186 could let a remote attacker execute arbitrary code through improper control of code generation; IBM scores both 9.8, network-reachable with no privileges and no user interaction.² CVE-2026-110193 (8.8) lets an attacker with a low-privileged account cause the Agentic Assistant to generate or submit component code that runs operating system commands on the server, and CVE-2026-110192 (6.5) lets an authenticated attacker obtain sensitive information from insufficiently protected credentials.² IBM's summary also refers to "an incomplete remediation of an auto-login security control" and "unauthenticated remote code execution exploitable through model context protocol tool enumeration".² The Hacker News adds that on 29 October IBM published CVE records for 29 other Langflow flaws fixed in 1.12.4 and 1.12.5, one of them, CVE-2026-104339, rated 9.8 and described as allowing arbitrary code execution with no account.¹

IBM lists Langflow OSS 1.0.0 through 1.12.8 as affected and tells users to upgrade to 1.13.0, with no interim workaround; it says to back up the database, secret key and uploaded files first, and to prepare the account for password sign-in if the deployment uses automatic login.² The National Vulnerability Database records both critical CVEs with the same range, from 1.0.0 up to but excluding 1.13.0.³⁴ Langflow's own post dates version 1.13 to 22 October, and The Hacker News reports that 1.12.8, released the same day, still has the flaws.⁷¹ Langflow says official Python packages, tagged source archives and Docker images now set LANGFLOW_AUTO_LOGIN to false, that users must set a superuser password before starting 1.13 or may be unable to sign in, and that operators can still set it to true for trusted environments.⁷

The Hacker News reports that neither critical flaw is in CISA's Known Exploited Vulnerabilities catalog as of its 30 October update, which lists six other Langflow flaws.¹ Ostorlab says no exploitation of these CVEs has been reported.⁸ A Metasploit module for CVE-2026-93680 is public: Rapid7 describes it as connecting to the MCP server-sent events endpoint without credentials, initialising an MCP session and retrieving MCP information, and The Hacker News reports it lists the server's tools without running code.⁵¹ GitHub shows the module was merged on 8 October, before IBM's bulletin, and that it was demonstrated against Langflow 1.8.4.⁶ The module's author lists Langflow 1.5.0 through 1.11.4 as affected, narrower than IBM's range.⁵⁶ On exploit code the sources differ: the Centre for Cybersecurity Belgium says a functional proof of concept for CVE-2026-93680 has been publicly released, raising the likelihood of exploitation, while Ostorlab says no public proof of concept exists for any of the October 2026 CVEs and that it reconstructed its attack path from IBM's bulletin and the 1.12.8 source.⁹⁸

The Hacker News reports that the Metasploit module was tested with automatic login turned on and that the bulletin does not say whether servers with it off are vulnerable.¹ Ostorlab's analysis of the 1.12.8 source says the unauthenticated chain starts at the /api/v1/auto_login endpoint, which hands out a superuser session only when LANGFLOW_AUTO_LOGIN is on, the default in every affected release, and returns a 403 when it is off.⁸ Ostorlab says an operator who sets the option back to true after upgrading reopens that endpoint.⁸ The Metasploit module's description instead centres on unauthenticated access to the MCP endpoint.⁵

Why it matters: two critical flaws need no account and IBM offers no workaround, so exposed instances depend on upgrading to 1.13.0, and only Ostorlab, not IBM, says whether a server with automatic login off is affected.²⁸