Langflow OSS CVE-2026-93680 and CVE-2026-110186: Two Unauthenticated Critical Flaws (CVSS 9.8), Fixed Only in 1.13.0

TL;DR: IBM has disclosed two critical flaws in Langflow OSS, the open-source tool for building AI agents and workflows. Neither needs an account. CVE-2026-93680 is an authentication bypass and CVE-2026-110186 allows arbitrary code execution. IBM rates both CVSS 3.1 9.8. A third flaw, CVE-2026-110193 (CVSS 8.8), lets any signed-in user with an ordinary account get OS command execution through the Agentic Assistant. IBM says every release from 1.0.0 through 1.12.8 is affected and the only fix is Langflow 1.13.0. IBM lists no workaround (IBM security bulletin).

Why act now: Langflow 1.13.0 came out on 22 October 2026. IBM published its bulletin on 28 October and updated it on 29 October, the same day the CVE records went public. The fix has been out since 22 October, so this is not an early warning about a fix that hasn't shipped. It is a window to patch before attackers move, and attackers have moved on Langflow before: CISA's KEV catalog already lists six older Langflow flaws.

What we know and don't know (as of 2 November 2026):

• No known exploitation. We found no reports of attacks using these three CVEs. None of them is in CISA's KEV catalog (catalog version 2026.10.30, checked 2 November 2026 at 16:21 Cyprus/Nicosia time, UTC+2). CISA's own enrichment on the CVE records marks exploitation as "none" (CVE-2026-93680 record).
• Public tooling exists for the auth bypass, but not for code execution. A Metasploit module that cites CVE-2026-93680 connects to Langflow's MCP endpoint without credentials and lists the tools the server exposes. It does not run code or commands (Metasploit module).
• IBM has not said which CVE matches which attack path. The bulletin summary mentions "unauthenticated remote code execution exploitable through model context protocol tool enumeration" and "an incomplete remediation of an auto-login security control," but it does not tie those phrases to specific CVE IDs.

Technical Information: the three CVEs in IBM's words

All three come from the same IBM bulletin. IBM is the CVE numbering authority (CNA) that published all three records. NVD shows IBM's scores and lists Langflow from 1.0.0 up to, but not including, 1.13.0 as vulnerable (NVD CVE-2026-93680).

The same bulletin also lists CVE-2026-110192 (CVSS 6.5, an authenticated credential exposure) and three flaws in the bundled Hono web framework. They are lower severity and are fixed by the same upgrade.

On privileges: CVE-2026-93680 and CVE-2026-110186 are scored PR:N, meaning no account is needed. CVE-2026-110193 is the only one of the three that needs a login. In our assessment (not IBM's), that bar may be low on some servers: where automatic login (below) is on, it signs every visitor in as a superuser, and open self-registration hands out accounts too.

CISA's SSVC enrichment on the CVE records rates CVE-2026-93680 and CVE-2026-110186 as "Automatable: yes" with "Technical Impact: total". It rates CVE-2026-110193 as "Automatable: no." In SSVC terms, "Automatable: yes" means CISA judges that an attacker could automate exploitation of the two unauthenticated flaws across many targets. It is not a report of exploitation.

Automatic login and MCP: what is confirmed and what is reported

Langflow can publish flows as tools to AI apps over the Model Context Protocol (MCP). It also has an automatic login mode (LANGFLOW_AUTO_LOGIN) that signs users in as a superuser without asking for a password. The sources say different things about these two features, so we separate them here.

Confirmed from primary sources:

• IBM: The bulletin summary mentions an "incomplete remediation of an auto-login security control" and "unauthenticated remote code execution exploitable through model context protocol tool enumeration." IBM's upgrade steps tell auto-login users to "prepare the existing account for password sign-in" before upgrading.
• Langflow source code: In the v1.12.8 tag, AUTO_LOGIN defaults to True, and its own description warns that it "bypasses authentication and should only be used in development environments." In v1.13.0 the default is False.
• Metasploit module: The module's author lists Langflow 1.5.0 through 1.11.4 as affected, which is narrower than IBM's 1.0.0 to 1.12.8. The module documentation says it was tested on Langflow 1.8.4 in Docker with LANGFLOW_AUTO_LOGIN=true. It opens the MCP SSE endpoint (/api/v1/mcp/sse), starts an MCP session and runs tools/list. It is an auxiliary "gather" module. It collects information and does not execute code.

Reported by The Hacker News, not stated by IBM:

• The Hacker News presents the MCP tool-enumeration phrase as describing "one of the flaws." IBM has not said which CVE it refers to (The Hacker News, 2 November 2026).
• The Hacker News notes that the bulletin "does not say whether servers with automatic login turned off are vulnerable." That remains an open question. Until IBM answers it, treat servers with auto-login off as affected too, because IBM's affected range has no configuration exception.

What we are not saying: We are not claiming that the Metasploit module achieves code execution, and we are not claiming that anyone is exploiting these CVEs.

Affected Product Versions and the fix

• Affected (IBM): Langflow OSS 1.0.0 through 1.12.8, every release in that range.
• Fixed: Langflow 1.13.0 only. It went up on PyPI and GitHub late on 22 October 2026 (UTC). Version 1.12.8 came out a few hours earlier the same day and is still vulnerable.
• No backport: As of 2 November 2026, PyPI has no 1.12.x release after 1.12.8. The only newer builds are 1.13.1 release candidates and 1.14.0 development builds, which are pre-releases.
• No workaround: IBM's bulletin says "Workarounds and Mitigations: None" and "no separate interim workaround is provided."

Workaround and Mitigation

IBM lists no workaround ("Workarounds and Mitigations: None"). The only vendor remedy is upgrading to Langflow 1.13.0. What to do now:

1. Find every Langflow instance, including internal AI tooling, proofs of concept, notebooks and Docker hosts. Langflow listens on port 7860 by default. Check pip environments (pip show langflow) and container images (langflowai/langflow).
2. Upgrade to 1.13.0. IBM's steps are as follows. Back up the database, the secret key and uploaded files. If the server uses automatic login, prepare the existing account for password sign-in. Then run pip install --upgrade "langflow==1.13.0", or move Docker deployments to langflowai/langflow:1.13.0 and keep the persistent data.
3. Don't delete or reinstall to get back in. If you can't sign in after upgrading, follow Langflow's recovery guidance from the 1.13.0 release. The Hacker News notes that Langflow's documentation warns a reinstall can permanently remove your flows.
4. Until you can upgrade, take instances off the internet. This is our generic exposure-control advice, not an IBM or Langflow workaround. Put Langflow behind VPN or SSO, block port 7860 and /api/v1/mcp/ at the edge, and turn off automatic login where you can. None of this fixes the flaws.
5. Check for signs of earlier access. Look for unexpected MCP sessions, new flows or custom components, new users, and outbound connections from Langflow hosts. Rotate the API keys and model provider credentials stored in Langflow if an instance was reachable from the internet. See Indicators of Compromise below.

Indicators of Compromise

IBM, Langflow and CISA have not published indicators of compromise for these CVEs, and we have none to share. No exploitation has been reported. The closest public signal is the Metasploit module's own behaviour: according to its source, it opens /api/v1/mcp/sse without credentials and then sends MCP initialize and tools/list requests, and Metasploit flags the module as leaving traces in logs. Treat unauthenticated requests to /api/v1/mcp/ from unknown sources as a lead to investigate, not as proof of compromise.

Third-party risk: questions for your vendors

Companies that build AI agents, chatbots or workflow automation often run Langflow themselves. Some of them expose it to customers or partners through MCP. A vulnerable Langflow server can hold model API keys, connector credentials and customer data that flows through it.

Ask your critical vendors, especially SaaS providers that offer AI features:

• Do you run Langflow anywhere, including internal AI tooling, prototypes, or components built into your product?
• Can any Langflow instance or MCP endpoint be reached from the internet, and is automatic login turned on anywhere?
• When were you, or when will you be, on Langflow 1.13.0? If you can't upgrade yet, what is restricting access until then?
• If an instance was reachable from the internet before the upgrade, have you reviewed it for unauthorized access and rotated the credentials stored in it?

Record the answers and the date. Ask again if CISA adds any of these CVEs to its KEV catalog or attacks are reported.

Forward this to your TPRM owner: IBM disclosed two critical Langflow OSS flaws (CVE-2026-93680 auth bypass, CVE-2026-110186 code execution), both CVSS 9.8 and neither needing an account, plus CVE-2026-110193 (8.8, OS command execution for any signed-in user). All versions from 1.0.0 to 1.12.8 are affected. The only fix is 1.13.0, out since 22 October, and IBM lists no workaround. They are not in CISA KEV and no exploitation is known, but a public Metasploit module already enumerates MCP tools through CVE-2026-93680 without credentials. Ask AI and workflow vendors whether they run Langflow, whether it is exposed to the internet, and when they will be on 1.13.0.

Need help finding which of your vendors run Langflow and tracking their upgrades? Our team can help you prioritize them and follow up on their answers.

Sources

• IBM: Security Bulletin, "Langflow OSS is affected by multiple vulnerabilities" (first published 28 October 2026, updated 29 October 2026): https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2
• Langflow: Release v1.13.0 (22 October 2026): https://github.com/langflow-ai/langflow/releases/tag/v1.13.0
• Langflow source: AUTO_LOGIN default at tag v1.12.8: https://github.com/langflow-ai/langflow/blob/v1.12.8/src/lfx/src/lfx/services/settings/auth.py and at tag v1.13.0: https://github.com/langflow-ai/langflow/blob/v1.13.0/src/lfx/src/lfx/services/settings/auth.py
• CVE records (CNA IBM, published 29 October 2026): https://www.cve.org/CVERecord?id=CVE-2026-93680, https://www.cve.org/CVERecord?id=CVE-2026-110186, https://www.cve.org/CVERecord?id=CVE-2026-110193
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93680, https://nvd.nist.gov/vuln/detail/CVE-2026-110186, https://nvd.nist.gov/vuln/detail/CVE-2026-110193
• GitHub Advisory Database (unreviewed): https://github.com/advisories/GHSA-vfwm-g9g9-v2g5, https://github.com/advisories/GHSA-mm82-q33r-3rjw, https://github.com/advisories/GHSA-4h9m-rvg4-x39r
• Rapid7 Metasploit Framework: auxiliary/gather/langflow_auth_bypass_cve_2026_93680: https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680.rb
• PyPI: langflow release history: https://pypi.org/project/langflow/#history
• The Hacker News: "Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers" (2 November 2026): https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html
• CISA: KEV catalog (version 2026.10.30, checked 2 November 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog