Update: Langflow patches two critical no-login flaws — only version 1.13.0 is fixed

Update, November 5, 2026: IBM's bulletin is unchanged since October 29, and 1.13.0 is still the only fixed release it names. None of the new CVEs is in CISA's Known Exploited Vulnerabilities catalog (version of November 4). On November 4 a user opened a public GitHub issue about CVE-2026-93680 that included proof-of-concept material; Langflow maintainers closed it on November 5 and asked for it to be re-filed privately through IBM's HackerOne programme. Assume exploitation details are circulating and patch accordingly.

IBM has disclosed four new security flaws in Langflow, the open-source AI agent builder. Two of them are rated critical (CVSS 9.8) and can be used without logging in. Every release from 1.0.0 through 1.12.8 is affected, and only version 1.13.0, released October 22, 2026, contains the fixes. If you run Langflow yourself, back up and upgrade now; IBM lists no workaround.

This is an update to our October 16 article on an earlier Langflow MCP flaw. The fixes described there (1.9.0 and 1.10.3) do not protect against the flaws below.

What happened, in plain English

Langflow is a visual tool for building AI applications. You drag blocks such as "language model", "search my documents" or "call this API" onto a canvas and wire them together, and Langflow runs the result as a web service. Teams often host it on their own servers, close to databases and the API keys for services like OpenAI.

Langflow can also act as an MCP server. MCP (Model Context Protocol) is a common standard that lets AI assistants discover and use "tools", such as the flows you built in Langflow.

On October 28, 2026, IBM, which maintains Langflow, published a security bulletin listing several flaws. Two matter most:

• CVE-2026-93680: an authentication flaw. Parts of Langflow that should require a login can be reached without one.
• CVE-2026-110186: a code-generation flaw that, according to IBM, "could allow a remote attacker to execute arbitrary code". In other words, someone on the network can make the server run commands of their choosing.

An analogy: Langflow is a workshop full of power tools and keys to other buildings. These bugs are like a side door that was left unlocked, plus a machine inside that will build whatever an intruder describes.

Two more flaws need an account. CVE-2026-110193 (8.8) lets a low-privileged user get Langflow's built-in "Agentic Assistant" to produce code that runs operating system commands. CVE-2026-110192 (6.5) can expose stored credentials to a logged-in user. The bulletin also lists three medium-severity flaws in Hono, a third-party web library Langflow uses.

Are you affected? What to do now

Who is affected: anyone running Langflow OSS 1.0.0 through 1.12.8, self-hosted via pip or Docker. Version 1.12.8 was released the same day as 1.13.0 and is still vulnerable. IBM's bulletin does not cover hosted Langflow services; if you use one, ask your provider. If nobody in your organisation runs Langflow, you have nothing to do.

How to check:

• Find Langflow instances: look for the langflow Python package (pip show langflow), the langflowai/langflow Docker image, or services listening on port 7860, Langflow's default.
• Check the version in the Langflow interface, in pip show langflow, or in the Docker image tag.
• Check whether the instance is reachable from the internet or from broad internal networks.
• Check whether automatic login is on (LANGFLOW_AUTO_LOGIN). When it is on, Langflow signs every visitor in as a superuser.

What to do, in order:

1. Back up the database, the secret key and uploaded files. IBM asks for this before upgrading.
2. If you use automatic login, set up password sign-in first. Version 1.13.0 turns automatic login off by default, and IBM says to prepare the existing account before upgrading. Langflow's docs include recovery steps if you get locked out.
3. Upgrade to Langflow 1.13.0 from PyPI, or move your Docker deployment to the 1.13.0 image while keeping persistent data. IBM lists no interim workaround. After upgrading, do not switch automatic login back on.
4. Until you can upgrade, take the instance off the internet or put it behind a VPN or an authenticating reverse proxy, and turn automatic login off. This is our suggestion, not IBM guidance.
5. If an instance was exposed, treat the API keys and database credentials stored in it as possibly compromised and rotate them. Review server logs for unexpected access to MCP endpoints and for flows or components you did not create.

No official indicators of compromise (IOCs) have been published.

The expert view

Root cause. IBM classes CVE-2026-93680 as improper authentication (CWE-287) and CVE-2026-110186 as improper control of code generation (CWE-94). The bulletin is terse, so the exact mechanics are not public from IBM. Secondary reporting (The Hacker News) describes CVE-2026-110186 as reachable through the MCP tool-enumeration path. A public Metasploit module for CVE-2026-93680 confirms one piece of this: it connects to Langflow's MCP endpoint without credentials and lists the server's metadata and tools. The module only gathers information and does not run code.

Security firm Ostorlab (October 30, updated November 3) describes the two critical bugs as a chain. In its reading, the automatic-login feature hands a superuser session to any caller, and that session opens Langflow's MCP interface, where flows can run code on the server. Ostorlab says an earlier fix only shortened the lifetime of that session. It also says instances where automatic login was explicitly turned off, with a real admin account set up, are not exposed to the no-login chain, though they remain exposed to the two flaws that need an account. IBM has not confirmed this.

Why this keeps happening. Langflow is a code-execution product by design: custom components are Python, and the platform exists to run user-defined logic. That makes every authentication gap a potential remote code execution. The MCP interface added a second front door, and both this flaw and the one we covered on October 16 sit at it. Automatic login, which made Langflow behave as if every visitor were a superuser, was on by default until 1.13.0. On a server with automatic login enabled, the boundary between "can reach the port" and "is the administrator" barely existed.

Severity in context. The two 9.8 scores look justified: network-reachable, no login, no user interaction, full impact. The real-world risk is high because attackers already target Langflow. CISA's Known Exploited Vulnerabilities (KEV) catalog lists six Langflow flaws, the most recent (CVE-2026-9198) added on August 4, 2026. None of the new CVEs was in KEV as of the November 4, 2026 catalog, and IBM's bulletin does not mention exploitation. Public tooling and the proof-of-concept posted on GitHub on November 4 shorten the time from disclosure to scanning, so we expect that status to be re-checked often.

Discrepancies and unknowns.

• The Metasploit module lists 1.5.0 through 1.11.4 as affected and gives a disclosure date of September 22, 2026. The November 4 GitHub issue gives two conflicting ranges and mentions 1.12.3 as a fix. IBM lists 1.0.0 through 1.12.8 and names only 1.13.0. We follow IBM, the vendor.
• It is not clear how CVE-2026-93680 relates to the MCP flaw tracked as GHSA-w794-rj3p-xv45, which we reported on October 16 with a fix in 1.10.3. IBM's statement that 1.12.8 is affected means the earlier fix is not enough.
• IBM has not said whether servers with automatic login turned off are exposed to both critical flaws (Ostorlab says they are not exposed to the no-login chain). IBM also has not said who found the flaws or whether they have been used in attacks.
• IBM published separate Langflow bulletins earlier in October with fixes in 1.12.4 and 1.12.5. Version 1.13.0 is the only release IBM names for this latest set.

The broader lesson applies to every agent builder: they hold credentials, run code and now expose MCP interfaces. Treat them like CI/CD (continuous integration and delivery) servers, with no public exposure, real authentication and fast patching.

Official sources

• IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (published October 28, 2026, updated October 29)
• CVE-2026-93680, CVE record (CNA: IBM)
• CVE-2026-110186, CVE record (CNA: IBM)
• Langflow 1.13.0 release notes (October 22, 2026)
• CISA Known Exploited Vulnerabilities catalog
• Metasploit module for CVE-2026-93680 (Rapid7 metasploit-framework)
• Langflow GitHub issue #16175 (opened November 4, closed by maintainers November 5)
• Analysis: Ostorlab, "Langflow Auto-Login Superuser Bypass, RCE via MCP (CVE-2026-93680)" (October 30, updated November 3)
• Coverage: The Hacker News: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers (November 2, 2026)