Critical Vulnerabilities in Langflow Allow Remote Code Execution

2 November 2026 3 min read هدهد تك | Hudhud Tech

Two critical vulnerabilities in Langflow could allow remote attackers without accounts to bypass authentication or execute arbitrary code, IBM reported on November 2, 2026.

Langflow is an open-source tool designed for building AI agents and workflows, with its vulnerability reports directed to IBM. All versions from 1.0.0 to 1.12.8 are affected, and the only available fix is version 1.13.0.

As of the October 30 update, neither flaw is included in CISA’s Known Exploited Vulnerabilities catalog. However, six other vulnerabilities in Langflow are listed there, including CVE-2026-9198, which was added in August.

Details of the Vulnerabilities

The four vulnerabilities highlighted in IBM’s bulletin, first published on October 28 and updated the following day, are:

CVE-2026-93680: CVSS score of 9.8 (Critical) – Allows bypassing security restrictions due to improper authentication.
CVE-2026-110186: CVSS score of 9.8 (Critical) – Enables running arbitrary code due to improper control of code generation.
CVE-2026-110193: CVSS score of 8.8 (High) – Requires a low-privileged account to make the Agentic Assistant generate or submit component code that executes operating system commands on the server.
CVE-2026-110192: CVSS score of 6.5 (Medium) – Requires an account to access sensitive information from insufficiently protected credentials.

One of the vulnerabilities allows for unauthenticated remote code execution through model context protocol tool enumeration, according to IBM. Langflow can present its flows as tools to AI applications that support the Model Context Protocol (MCP).

A module in the public Metasploit Framework already references CVE-2026-93680, the authentication bypass. It connects to a Langflow server’s MCP endpoint without credentials, initiates a session, and lists the tools available on the server, but does not execute code or commands.

The author of the module identifies Langflow versions 1.5.0 to 1.11.4 as affected, which is a narrower range than IBM’s assessment.

When automatic login is enabled, Langflow logs users in as superusers without requiring them to sign in. The LANGFLOW_AUTO_LOGIN setting is enabled by default in Langflow version 1.12.8, with a code description warning that it bypasses authentication and should only be used in development environments.

Upgrading to Version 1.13.0

Langflow version 1.13.0 was released on October 22. The previous version, 1.12.8, released on the same day, still contains the vulnerabilities, and as of November 2, no later 1.12 release is listed on PyPI. IBM has not provided a workaround for servers unable to upgrade.

Version 1.13 disables automatic login by default. To upgrade, users should:

Back up the database, secret key, and uploaded files.
If automatic login is in use, prepare the existing account for password sign-in as described in Langflow’s upgrade guidance.
Upgrade the Python package using the command: pip install –upgrade “langflow==1.13.0”. For Docker, switch to the langflowai/langflow:1.13.0 image while retaining the deployment’s persistent data.
If unable to sign in post-upgrade, follow the recovery steps linked in the upgrade guidance. Users should not delete or reinstall Langflow to regain access, as this may permanently remove their flows.

On October 29, IBM also published CVE records for 29 additional Langflow vulnerabilities, identifying versions 1.12.4 and 1.12.5 as their fixes. One of these, CVE-2026-104339, could also allow an attacker without an account to run arbitrary code, with a CVSS score of 9.8. None of the 33 records, including these four, list version 1.13.0 as affected.

Source: The Hacker News

What do you think of this story?