Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers Swati KhandelwalNov 02, 2026Vulnerability / Artificial Intelligence Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0. Neither flaw is in CISA's Known Exploited Vulnerabilities catalog, as of the catalog's October 30 update. Six other Langflow flaws are listed there, most recently CVE-2026-9198, which was added in August. The four Langflow flaws in IBM's bulletin, first published on October 28 and updated the next day, are: CVE CVSS score (IBM) Account needed What IBM says it could allow CVE-2026-93680 9.8 (Critical) No Bypassing security restrictions, because of improper authentication CVE-2026-110186 9.8 (Critical) No Running arbitrary code, because of improper control of code generation CVE-2026-110193 8.8 (High) Yes, a low-privileged account Making the Agentic Assistant generate or submit component code that runs operating system commands on the server CVE-2026-110192 6.5 (Medium) Yes Getting sensitive information from insufficiently protected credentials One of the flaws is "unauthenticated remote code execution exploitable through model context protocol tool enumeration," according to IBM. Through the Model Context Protocol (MCP), Langflow can offer its flows as tools to AI apps that support MCP. A module in the public Metasploit Framework already cites CVE-2026-93680, the authentication bypass. It connects to a Langflow server's MCP endpoint without credentials, starts a session, and lists the tools the server offers. It does not run code or commands on the server. Its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM's. When automatic login is enabled, Langflow logs users in as superusers without prompting them to sign in. The setting LANGFLOW_AUTO_LOGIN is enabled by default in Langflow 1.12.8. Its code description warns that it "bypasses authentication and should only be used in development environments." The module was tested on Langflow 1.8.4 with automatic login turned on. Another of the four flaws is "an incomplete remediation of an auto-login security control," according to IBM. The bulletin does not say whether servers with automatic login turned off are vulnerable. Langflow 1.13.0 came out on October 22. Version 1.12.8, released the same day, still has the flaws, and PyPI lists no later 1.12 release as of November 2. IBM offers no workaround for servers that cannot upgrade yet. Langflow 1.13 turns automatic login off by default. To upgrade: Back up the database, the secret key and uploaded files. If the server uses automatic login, prepare the existing account for password sign-in, as Langflow's upgrade guidance describes. Upgrade the Python package with pip install --upgrade "langflow==1.13.0". For Docker, move to the langflowai/langflow:1.13.0 image and keep the deployment's persistent data. If you cannot sign in after upgrading, follow the recovery steps that the same guidance links to. Do not delete or reinstall Langflow to get access back, because Langflow's documentation warns this can permanently remove your flows. On October 29, IBM also published CVE records for 29 other Langflow flaws and named versions 1.12.4 and 1.12.5 as their fixes. One of them, CVE-2026-104339, could also let an attacker with no account run arbitrary code, and IBM rates it 9.8. None of the 33 records, these four included, lists 1.13.0 as affected. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. API Security, Application Security, artificial intelligence, Vulnerability Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers AI-Generated Fake Login Pages Are Making Account Takeovers Easier Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Experts Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security