Critical vulnerabilities have been discovered in Langflow, a tool used for constructing AI agents and workflows. IBM reported last week that these flaws could let unauthenticated attackers execute arbitrary code or bypass security protocols. The flaws are present in all releases from version 1.0.0 to 1.12.8, with the only remedy being an upgrade to version 1.13.0.
Details of Langflow Security Flaws
The two primary vulnerabilities identified, CVE-2026-93680 and CVE-2026-110186, have been rated as critical. Both allow attackers to either bypass authentication or execute arbitrary code, posing a significant risk to server security. Notably, these vulnerabilities are not listed in the CISA’s Known Exploited Vulnerabilities catalog, highlighting the importance of upgrading to the latest version.
IBM’s bulletin, updated on October 29, outlines four specific vulnerabilities. Among these, CVE-2026-93680 and CVE-2026-110186 require no user account to exploit. Another flaw, CVE-2026-110193, can be exploited with a low-privileged account to execute operating system commands. The medium severity flaw, CVE-2026-110192, risks exposing sensitive information.
Exploitation and Impact
The vulnerabilities are particularly concerning because they allow remote code execution via the Model Context Protocol (MCP), used by Langflow to offer flows as tools to AI applications supporting MCP. A module in the Metasploit Framework already references the authentication bypass flaw CVE-2026-93680. This module connects to Langflow servers without credentials, starting a session without executing commands.
Automatic login exacerbates the risk, as Langflow versions up to 1.12.8 have this feature enabled by default. The auto-login functionality logs users in as superusers, bypassing authentication. IBM advises against using this setting outside of development environments. The tested module on version 1.8.4 confirms the risk when automatic login is active.
Mitigation Steps and Future Outlook
Langflow version 1.13.0, released on October 22, addresses these vulnerabilities by disabling automatic login by default. Administrators are urged to upgrade promptly by following the recommended steps, including backing up necessary data and preparing accounts for password sign-in. For Docker users, transitioning to the langflowai/langflow:1.13.0 image is advised to maintain persistent data.
In addition to these critical fixes, IBM has disclosed 29 other vulnerabilities in Langflow, with versions 1.12.4 and 1.12.5 offering some remedies. The urgency to upgrade remains high, as none of these vulnerabilities, including the new ones, are addressed in version 1.13.0. Ensuring systems are updated is crucial to protect against potential exploits.
