IBM discloses four Langflow vulnerabilities — two with CVSS 9.8 allow unauthenticated code execution

Langflow OSS — a popular open-source tool for building AI agents and workflows — contains four vulnerabilities, two of which allow a remote attacker without an account to bypass authentication or execute arbitrary code on the server. According to an IBM security advisory published on October 28, 2026, all versions from 1.0.0 to 1.12.8 are affected. The only fix is to upgrade to version 1.13.0. IBM does not offer any interim workarounds, which makes upgrading urgent for all Langflow operators.

Vulnerability details

The IBM advisory describes four vulnerabilities with different attack vectors and severity levels:

• CVE-2026-93680 (CVSS 9.8, IBM) — authentication bypass (CWE-287). Allows a remote attacker to bypass security restrictions due to improper authentication.
• CVE-2026-110186 (CVSS 9.8, IBM) — arbitrary code execution without authentication (CWE-94). According to IBM, exploitation is possible via enumeration of Model Context Protocol (MCP) tools — the protocol through which Langflow exposes its flows as tools for AI applications.
• CVE-2026-110193 (CVSS 8.8, IBM) — operating system command execution (CWE-94). Requires authentication with minimal privileges: an attacker can cause the built-in Langflow AI assistant to generate or send component code that results in arbitrary operating system commands being executed.
• CVE-2026-110192 (CVSS 6.5, IBM) — disclosure of sensitive information (CWE-522). An authenticated attacker can obtain sensitive data due to insufficient protection of credentials.

Public exploit and discrepancy in affected versions

A public module for CVE-2026-93680 already exists in the Metasploit Framework. The module connects to the Langflow server’s MCP SSE endpoint without credentials, initializes a session, and retrieves a list of available tools. The module does not execute arbitrary code or run commands on the server, but it demonstrates that the authentication bypass is practically exploitable. Based on available information, confirmed exploitation of these vulnerabilities in real-world attacks has not yet been observed — none of the four CVEs is listed in the CISA KEV catalog as of October 30, 2026.

A notable detail: the Metasploit module’s author lists the affected version range as 1.5.0–1.11.4, whereas IBM defines it more broadly — 1.0.0–1.12.8. This discrepancy remains unresolved: the Rapid7 range refers to that specific module and does not contradict the wider coverage claimed by IBM in its product advisory.

The role of auto-login in risk assessment

The real degree of exposure depends not only on the version but also on the authentication configuration. Analysis of the Langflow 1.12.8 source code shows that the LANGFLOW_AUTO_LOGIN parameter is enabled by default. When auto-login is active, the system logs users in as superusers without prompting for credentials. The code itself includes a warning: this feature “bypasses authentication and should only be used in development environments.” The Metasploit module was tested specifically on Langflow 1.8.4 with auto-login enabled. At the same time, IBM does not clarify whether servers with auto-login disabled are vulnerable.

Langflow 1.13.0, released on October 22, 2026, disables auto-login by default. This means that when upgrading from versions where auto-login was active, you must prepare an existing account for password-based login — otherwise, access to the system will be lost after the upgrade.

Upgrade recommendations

IBM does not provide any interim workarounds — the only recommendation is to upgrade to version 1.13.0. The steps, according to the Langflow documentation and the IBM advisory, are as follows:

1. Create a backup of the database, secret key, and uploaded files.
2. If the server uses auto-login, prepare an existing account for password-based login before upgrading.
3. Upgrade the Python package: pip install --upgrade "langflow==1.13.0". For Docker, switch to the langflowai/langflow:1.13.0 image while preserving persistent deployment data.
4. If login is not possible after the upgrade, use the recovery procedure from the documentation. Do not delete or reinstall Langflow — this may lead to irreversible loss of workflows.

To detect possible exploitation attempts, you should review access and application logs for unauthenticated requests to the MCP SSE endpoint followed by initialization of MCP sessions — this is the vector used by the public Metasploit module.

Broader context of Langflow vulnerabilities

This advisory is not the only one. On October 29, IBM also published CVE entries for 29 additional Langflow vulnerabilities fixed in versions 1.12.4 and 1.12.5. Among them is CVE-2026-104339 with a CVSS score of 9.8, which also allows an unauthenticated attacker to execute arbitrary code. This vulnerability affects versions 1.0.0–1.12.3 and is fixed in 1.12.4. None of the 33 CVE entries lists version 1.13.0 as vulnerable.

We previously wrote about the Langflow vulnerability CVE-2026-9198, which was added to the CISA KEV catalog in August 2026. The current four vulnerabilities have not yet been added to the KEV catalog, but the existence of a public exploit for CVE-2026-93680 and the absence of workarounds increase the response priority.

Organizations using Langflow OSS should immediately upgrade to version 1.13.0, after first performing backups and preparing accounts. Tracking patches for Langflow requires monitoring several IBM advisories at the same time: if your deployment is running a version below 1.12.4, it is also exposed to the separate critical remote code execution vulnerability CVE-2026-104339, and a simple upgrade to an intermediate version is not enough — you need to move straight to 1.13.0.