Langflow: unauthenticated auth bypass and RCE flaws fixed in 1.13.0 (CVE-2026-93680, CVE-2026-110186)
Severity: critical · Patch status: patched · Since 2026-10-22 · CVE-2026-104339, CVE-2026-110186, CVE-2026-110192, CVE-2026-110193, CVE-2026-93680
IBM published a security bulletin on 2026-10-28 (updated 2026-10-29) covering four flaws in Langflow OSS 1.0.0 through 1.12.8. It names 1.13.0 as the only fix and gives no interim workaround. Two are CVSS 9.8 and need no account. CVE-2026-93680 lets a remote attacker bypass authentication, and CVE-2026-110186 lets a remote attacker execute arbitrary code through improper control of code generation. CVE-2026-110193 (CVSS 8.8) lets a low-privileged account make the Agentic Assistant generate component code that runs operating system commands. CVE-2026-110192 (CVSS 6.5) exposes credentials to an authenticated user. The Hacker News reports a public Metasploit module that lists MCP tools on auto-login-enabled servers without credentials. It does not run code. IBM describes one flaw as an incomplete fix of the auto-login control, and auto-login was on by default through 1.12.8. Langflow 1.13.0 (on PyPI 2026-10-22) turns auto-login off by default. IBM's separate CVE-2026-104339 (CVSS 9.8, unauthenticated OS command injection) affects 1.0.0 through 1.12.3 and is fixed in 1.12.4 and 1.12.5 according to The Hacker News. None of the CVEs above is in CISA KEV at the 2026.10.30 catalog, and we found no in-the-wild exploitation report. CVE-2026-9198, a different Langflow flaw added to KEV in August 2026, is a separate record.
What to do
- Upgrade to Langflow 1.13.0 (pip install --upgrade "langflow==1.13.0" or the langflowai/langflow:1.13.0 Docker image). Back up the database, secret key and uploaded files first, as IBM instructs
- If auto-login was enabled, prepare the existing account for password sign-in per Langflow's upgrade guidance before upgrading. Do not delete or reinstall to regain access, as this can permanently destroy flows
- IBM provides no interim workaround. Disabling LANGFLOW_AUTO_LOGIN and restricting network access to the server and its MCP endpoint are our suggestions, not IBM guidance. The bulletin does not say whether servers with auto-login off are vulnerable to CVE-2026-93680, so treat this as partial mitigation only
- Check server logs for unauthenticated access and MCP tool enumeration requests
- Confirm your version is at least 1.12.4 or 1.12.5 for the 29 other IBM CVEs fixed there, including CVE-2026-104339 (fix version per The Hacker News; IBM's bulletin lists only the four CVEs above)
Fixed versions
Sources
All live incidents on Threat Watch
