Critical Langflow flaws could let unauthenticated attackers run code on servers

Security bulletins from IBM describe four vulnerabilities in Langflow, an open-source tool for building AI agents and workflows, including critical bugs that could allow unauthenticated remote code execution, The Hacker News reports. The only fix is Langflow version 1.13.0, released October 22.

What happened

According to The Hacker News, IBM's security bulletin first published on October 28 and updated the next day lists four Langflow flaws. Two are rated critical at CVSS 9.8: CVE-2026-93680, which IBM says could allow bypassing security restrictions due to improper authentication, and CVE-2026-110186, which could allow running arbitrary code due to improper control of code generation. Neither requires an account. The other two require a low-privileged account: CVE-2026-110193 (CVSS 8.8), which IBM says could make Langflow's Agentic Assistant generate or submit component code that runs operating-system commands on the server, and CVE-2026-110192 (CVSS 6.5), an information-disclosure issue in how credentials are protected.

Technical details

Langflow can expose its flows as tools to AI apps through the Model Context Protocol (MCP). The report notes IBM describes one flaw as "unauthenticated remote code execution exploitable through model context protocol tool enumeration." A public Metasploit module already cites CVE-2026-93680; per the article, it connects to a Langflow MCP endpoint without credentials and lists the server's tools, but does not yet run code or commands. The article adds that the LANGFLOW_AUTO_LOGIN setting, enabled by default in version 1.12.8, signs users in as superusers without a prompt; Langflow's own code warns the option "bypasses authentication and should only be used in development environments." The bulletin does not clarify whether servers with automatic login disabled are vulnerable.

Who is affected

The Hacker News says "every release from 1.0.0 through 1.12.8" contains the flaws, while the Metasploit module's author lists a narrower range of 1.5.0 through 1.11.4. As of the article, none of the flaws appears in CISA's Known Exploited Vulnerabilities catalog, and the article does not report confirmed in-the-wild attacks. The report also notes IBM published CVE records for dozens of other Langflow flaws, including one rated 9.8 that could allow unauthenticated code execution.

What to do

Upgrade to Langflow 1.13.0, which turns automatic login off by default; IBM offers no workaround for servers that cannot upgrade. The report advises backing up the database, secret key and uploaded files first, and preparing the existing account for password sign-in if the server uses automatic login. It warns that deleting or reinstalling Langflow "can permanently remove your flows," so administrators should follow Langflow's upgrade and recovery guidance rather than reinstalling.