Two critical vulnerabilities in Langflow could allow remote attackers without an account to bypass authentication or execute arbitrary code, according to an IBM bulletin published on October 28 and updated the following day.
Langflow is an open-source platform for building AI agents and workflows, and its vulnerability reports are submitted to IBM. The affected range covers every release from version 1.0.0 through 1.12.8. IBM identifies version 1.13.0 as the fix.
CVE-2026-93680 and CVE-2026-110186 are both rated 9.8, or critical, by IBM and do not require an account. The first could allow attackers to bypass security restrictions through improper authentication, while the second could enable arbitrary code execution through inadequate control over code generation.
IBM also listed two additional Langflow vulnerabilities. CVE-2026-110193 is rated 8.8 and requires a low-privileged account; it could allow the Agentic Assistant to generate or submit component code that runs operating-system commands on the server. CVE-2026-110192 has a 6.5 rating and could expose sensitive information through insufficiently protected credentials.
One of the critical issues involves unauthenticated remote code execution through enumeration of Model Context Protocol tools. Langflow can expose its flows as tools to AI applications that support MCP.
A Metasploit Framework module already references CVE-2026-93680. It connects to a Langflow server's MCP endpoint without credentials, starts a session and lists the available tools, but does not execute code or commands. The module identifies versions 1.5.0 through 1.11.4 as affected, a narrower range than the one cited by IBM.
The reports also concern Langflow's automatic-login feature. When enabled, the setting logs users in as superusers without requesting credentials. In version 1.12.8, LANGFLOW_AUTO_LOGIN is enabled by default, and its code warns that the option bypasses authentication and should be used only in development environments. IBM describes another issue as an incomplete fix for an automatic-login security control, but does not specify whether systems with the feature disabled remain vulnerable.
Langflow 1.13.0 was released on October 22 and disables automatic login by default. IBM provides no workaround for installations that cannot upgrade. Administrators should back up the database, secret key and uploaded files before upgrading. Deployments using automatic login should also prepare the existing account for password-based sign-in according to Langflow's upgrade guidance.
The upgrade can be performed with pip using `pip install --upgrade "langflow==1.13.0"`. Docker deployments should use the `langflowai/langflow:1.13.0` image while retaining persistent data. Langflow warns against deleting or reinstalling the application to recover access after an upgrade, as this could permanently remove flows.
Neither of the two critical vulnerabilities appears in CISA's Known Exploited Vulnerabilities catalog as of its October 30 update. The catalog does include six other Langflow vulnerabilities, most recently CVE-2026-9198, added in August.
IBM published records for 29 additional Langflow vulnerabilities on October 29, identifying versions 1.12.4 and 1.12.5 as fixes for those issues. One of them, CVE-2026-104339, is also rated 9.8 and could allow unauthenticated arbitrary code execution. None of the 33 records listed version 1.13.0 as affected.
Sources: The Hacker News.