If you run Langflow anywhere, the version number decides how worried you should be. If it starts with anything from 1.0.0 to 1.12.8, your server has two critical vulnerabilities, each scored 9.8 out of 10, and an attacker needs no account to exploit either one. The fix is Langflow 1.13.0, released Oct. 22. According to the vendor bulletin, there is no workaround.

An IBM security bulletin dated Oct. 28 describes the problems. The CVE records followed in the National Vulnerability Database on Oct. 29. The Hacker News reported on the flaws on Nov. 2. One detail in that report is worth noting: Langflow 1.12.8 came out the same day as 1.13.0 and is still vulnerable. If someone on your team picked 1.12.8 as the newest 1.12-series release, they picked an unpatched build.

The two that matter most

CVE-2026-93680 is an improper-authentication flaw. The NVD record lists IBM's product security team as the source and the status as Analyzed. It says Langflow OSS 1.0.0 through 1.12.8 "could allow a remote attacker to bypass security restrictions due to improper authentication." The CVSS 3.1 vector reads AV:N/AC:L/PR:N/UI:N. In plain terms, the attack works over the network, takes little effort, needs no privileges, and needs no one to click anything. That combination produces the 9.8 score.

IBM's bulletin calls this an incomplete fix of an auto-login control. Auto-login is a convenience setting that lets users into the Langflow interface without signing in. That makes sense on a developer's laptop and is dangerous on a server other people can reach. The Hacker News reports that the LANGFLOW_AUTO_LOGIN setting was still on by default in 1.12.8 and that 1.13 turns it off. IBM describes the flaw as an incomplete remediation of an earlier auto-login security control, meaning the earlier fix did not fully close the gap. The bulletin does not say whether servers with auto-login turned off are affected.

CVE-2026-110186 is the code-execution bug. It affects the same versions and carries the same 9.8 score on NVD. IBM puts it under improper control of code generation, which means an attacker can get the application to build and run code they influence. Langflow exists to wire together agents and tools that act on a server, so code execution here means the attacker can run their own commands on that machine.

The rest of the bulletin

IBM's bulletin lists four Langflow CVEs in total, plus vulnerable bundled components. The other two CVEs are less severe than the first pair, and the bulletin summary also mentions two issue types without tying them to a specific CVE:

  • CVE-2026-110193 (CVSS 8.8): someone with a low-privileged account can get Langflow's Agentic Assistant to run operating-system commands. It needs an account, which is why it scores lower. On a shared instance with many users, that bar is low.
  • CVE-2026-110192 (CVSS 6.5): an authenticated attacker could obtain sensitive information because of insufficiently protected credentials. The bulletin summary also mentions exposure of API keys injected by the operator. Such keys are often credentials for paid AI services or internal systems.
  • Unauthenticated RCE via MCP tool enumeration: MCP, the Model Context Protocol, is a standard way for AI agents to discover and call outside tools. IBM's summary lists unauthenticated remote code execution exploitable through model context protocol tool enumeration as one of the issues covered.
  • Dependencies: the bulletin also lists vulnerable bundled libraries, such as the Hono web framework (CVE-2026-84363).

Is anyone exploiting this?

The available evidence gives a mixed answer. The Hacker News reports that neither unauthenticated flaw was in CISA's Known Exploited Vulnerabilities (KEV) catalog as of Oct. 30. KEV is the federal list of bugs with confirmed real-world exploitation. Langflow is no stranger to that list, though. The same report says six other Langflow vulnerabilities are already in KEV, so attackers have gone after this software before.

A public Metasploit module cites CVE-2026-93680. Metasploit is a widely used penetration-testing framework. According to The Hacker News, the module only lists the MCP tools an exposed instance offers and does not run code. That limits the immediate damage from the module itself. The module connects to a server's MCP endpoint without credentials, so a public tool now exists for probing exposed instances. That is an inference about risk, not a reported attack, and defenders should treat exposed servers as at risk.

What It Means for Defenders

Who is affected: anyone running Langflow OSS from 1.0.0 through 1.12.8. That covers every release before 1.13.0, including 1.12.8, which shipped on the same day as the fix.

What to do:

  • Upgrade to Langflow 1.13.0. The 1.13.0 release on GitHub, published Oct. 22, is the version both IBM and The Hacker News name as the fix. IBM offers no workaround, so you cannot get by with a configuration change instead of the upgrade.
  • Check that auto-login is off afterward. 1.13 turns LANGFLOW_AUTO_LOGIN off by default. A deployment script or environment file that sets it explicitly can turn it back on. Look at your container definitions and environment variables, not only the version string.
  • Take Langflow off the public internet. Put it behind a VPN, an authenticating reverse proxy, or at minimum a network allowlist. A tool built to run code on the host should not be reachable by anonymous users.
  • Treat exposed instances as possibly compromised. If an unpatched server could be reached from the internet, rotate every API key and credential stored in it. The credential-exposure and code-execution issues in the bulletin put those secrets at risk. Then review the host for unexpected processes, files and outbound connections.
  • Review accounts on shared instances. CVE-2026-110193 turns any low-privileged login into command execution on unpatched versions. Remove accounts nobody uses.
  • Update the bundled dependencies. The bulletin also covers vulnerable libraries such as Hono. IBM names the 1.13.0 upgrade as the remediation, so rebuild images from that release and re-scan them for the listed libraries.

For federal contractors working toward CMMC: an internet-facing AI workflow server holding service credentials is the kind of system assessors will ask about. Record when you upgraded and when you rotated keys.

Sources