Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

Summary

A November 2, 2026 report describes four Langflow vulnerabilities covered by an IBM security bulletin. Two are critical and require no account: CVE-2026-93680 permits authentication bypass, while CVE-2026-110186 could permit arbitrary code execution through improper control of code generation. IBM assigns both a CVSS score of 9.8. The other two flaws concern authenticated command execution through the Agentic Assistant and sensitive-information exposure involving credentials.^[0]

The reported affected range is Langflow 1.0.0 through 1.12.8, with 1.13.0 identified as the fix. Version 1.12.8 remains vulnerable despite being released on the same day as 1.13.0. IBM offers no workaround for deployments that cannot upgrade, making the version transition the documented remediation rather than a configuration-only change.^[0]

Public tooling demonstrates a narrower capability than the overall vulnerability impact: a Metasploit auxiliary module associated with CVE-2026-93680 opens an unauthenticated Model Context Protocol session and lists available tools, but does not execute code or commands. Its author identifies a narrower affected range than IBM and tested it on 1.8.4 with automatic login enabled. These limitations should not be confused with evidence that the separately reported remote-code-execution flaw is harmless or that other configurations are safe.^[0]

The supplied report does not describe exploitation of these four flaws in the wild. It states that neither critical flaw appeared in CISA's Known Exploited Vulnerabilities catalog as of the October 30 update; that bounded catalog check does not establish that exploitation has never occurred. All technical conclusions in this dossier rely on the supplied article's account, rather than independently supplied vendor or repository contents.^[0]

Disclosure timeline

How it works

CVE-2026-93680 is described as improper authentication that allows an unauthenticated remote attacker to bypass security restrictions. The associated public Metasploit auxiliary module connects to a Langflow MCP endpoint without credentials, starts a session, and lists the tools offered by the server. Langflow uses MCP to expose its flows as tools to compatible AI applications. The module demonstrates unauthorized session establishment and enumeration, not server-side command execution.^[0]

CVE-2026-110186 is described as improper control of code generation that could allow arbitrary code execution without an account. The article also quotes IBM describing an unauthenticated remote-code-execution issue exploitable through MCP tool enumeration. It does not provide the payload, vulnerable code path, or execution internals needed to reconstruct that behavior, and the enumeration-only Metasploit module should not be treated as an RCE demonstration.^[0]

CVE-2026-110193 requires a low-privileged account. An attacker could make the Agentic Assistant generate or submit component code that executes operating system commands on the server. IBM rates this issue 8.8, High. The article provides no specific malicious prompt, component payload, or demonstrated exploitation sequence.^[0]

CVE-2026-110192 requires an account and concerns insufficient protection of credentials, potentially allowing access to sensitive information. IBM rates it 6.5, Medium. The supplied account does not identify the credential storage mechanism or the exact information exposed.^[0]

Automatic login is an important configuration consideration, but the evidence does not establish a complete configuration-based exposure rule. In 1.12.8, LANGFLOW_AUTO_LOGIN defaults to enabled and signs users in as superusers without prompting for credentials. Its description warns that it bypasses authentication and should be used only in development. IBM also describes one flaw as an incomplete remediation of an auto-login security control, without clarifying whether disabling automatic login removes exposure.^[0]

The public module's reported scope and test conditions are narrower than the vendor scope summarized in the article: its author lists 1.5.0 through 1.11.4 and tested 1.8.4 with automatic login enabled, whereas IBM's reported affected range is 1.0.0 through 1.12.8. The module's narrower coverage does not substantiate excluding the other vendor-listed versions.^[0]

Affected versions and patch status

Key takeaways

• Keep the authentication-bypass demonstration separate from the reported RCE capability: the public auxiliary module enumerates MCP tools and explicitly does not execute server-side code or commands.^[0]
• Use the reported vendor affected range for remediation scope rather than narrowing exposure to the public module's version range or its single automatic-login-enabled test configuration.^[0]
• Automatic-login behavior changes during the fix: 1.12.8 enables it by default, while 1.13.0 disables it. Account migration and data preservation are therefore part of the patch operation, not incidental housekeeping.^[0]
• The evidence supports a patched vulnerability-disclosure narrative, not an attributed campaign. The reported absence of the two critical flaws from KEV is time-bounded and should not be represented as proof of no exploitation.^[0]

Defensive actions

• Upgrade affected Langflow deployments to version 1.13.0.: The article identifies 1.13.0 as the fix for the four flaws and reports no IBM workaround. It gives the Python-package command pip install --upgrade "langflow==1.13.0" and identifies langflowai/langflow:1.13.0 as the Docker image to use.^[0]
• Before upgrading, back up the database, secret key, and uploaded files, and preserve persistent deployment data when changing Docker images.: These are the article's explicit upgrade-preparation steps and protect the application data needed to retain the deployment's existing state.^[0]
• Prepare existing automatic-login accounts for password sign-in before moving to 1.13.0.: Version 1.13.0 disables automatic login by default. The article directs administrators using automatic login to prepare their existing account using Langflow's upgrade guidance before the transition.^[0]
• Review LANGFLOW_AUTO_LOGIN against its development-only warning, but do not treat disabling it on an affected release as a verified substitute for patching.: The setting automatically grants superuser login and defaults to enabled in 1.12.8. However, the article says IBM does not establish whether disabling it prevents exploitation and offers no workaround.^[0]
• If sign-in fails after the upgrade, use the documented recovery procedures rather than deleting or reinstalling Langflow.: The article reports that Langflow's documentation warns deletion or reinstallation can permanently remove flows.^[0]