Langflow Critical Flaws Need an Upgrade to 1.13.0

Two critical flaws in Langflow let a remote attacker with no account bypass authentication or run arbitrary code, according to an IBM bulletin summarized by The Hacker News on November 2. Every release from 1.0.0 through 1.12.8 is affected, and the only fix is version 1.13.0. IBM offers no workaround for servers that cannot upgrade yet.

Neither flaw is in CISA’s Known Exploited Vulnerabilities catalog as of the October 30 update. Six other Langflow flaws are listed there.

What IBM published

IBM’s bulletin, first published October 28 and updated the next day, covers four Langflow flaws. Scores below are IBM’s, as reported by The Hacker News.

• CVE-2026-93680 (9.8, critical): improper authentication, no account needed, allows bypassing security restrictions.
• CVE-2026-110186 (9.8, critical): improper control of code generation, no account needed, allows running arbitrary code.
• CVE-2026-110193 (8.8, high): needs a low-privileged account; lets the Agentic Assistant generate or submit component code that runs operating system commands on the server.
• CVE-2026-110192 (6.5, medium): needs an account; exposes sensitive information through insufficiently protected credentials.

One of the flaws is described by IBM as unauthenticated remote code execution reachable through Model Context Protocol (MCP) tool enumeration. MCP is how Langflow offers its flows as tools to AI apps.

Public tooling and the auto-login question

A module in the public Metasploit Framework already cites CVE-2026-93680. Per the report, it connects to a server’s MCP endpoint without credentials and lists the tools on offer. It does not run code or commands. Its author lists 1.5.0 through 1.11.4 as affected, a narrower range than IBM’s. For earlier Metasploit coverage of this product, see our look at the six Langflow modules.

There is an open question here. Langflow’s LANGFLOW_AUTO_LOGIN setting, which logs users in as superusers without a sign-in prompt, is enabled by default in 1.12.8, and its own code description says it should only be used in development. The module was tested on 1.8.4 with auto-login on, and IBM describes one of the four flaws as an incomplete remediation of an auto-login security control. The bulletin does not say whether servers with auto-login off are vulnerable. Until that is clear, assume they might be.

What to do

Langflow 1.13.0 shipped October 22, the same day as 1.12.8, which still has the flaws. PyPI lists no later 1.12 release as of November 2. Version 1.13 turns auto-login off by default.

1. Back up the database, the secret key and uploaded files.
2. If the server relies on auto-login, prepare the existing account for password sign-in, per Langflow’s upgrade guidance.
3. Upgrade the package to 1.13.0, or for Docker move to the 1.13.0 image and keep persistent data.
4. If you get locked out, use the recovery steps in that guidance. Do not delete and reinstall, because Langflow’s documentation warns that can permanently remove your flows.

IBM also published records on October 29 for 29 other Langflow flaws, naming 1.12.4 and 1.12.5 as fixes. One of them, CVE-2026-104339, could also allow unauthenticated code execution, and IBM rates it 9.8. None of the 33 records lists 1.13.0 as affected.

Analysis

Langflow has now had a steady drip of critical bugs, and the pattern has been consistent: a tool built for fast prototyping gets deployed on reachable servers with its development defaults intact. That is the same mistake, different decade. Earlier entries in the run include the unauthenticated RCE with a public PoC in August. With public tooling already citing one of these CVEs, the gap between disclosure and exploitation attempts tends to be short, so treat any internet-exposed Langflow instance as urgent.