{"slug": "critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers", "title": "Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers", "summary": "IBM published a security bulletin on October 28, updated October 29, disclosing four vulnerabilities in Langflow, the open-source tool for building AI agents and workflows, including two critical flaws scored 9.8 that require no account: CVE-2026-93680, an authentication bypass, and CVE-2026-110186, which allows arbitrary code execution through improper control of code generation. Every Langflow release from 1.0.0 through 1.12.8 is affected, and the only fix is version 1.13.0, released October 22, which turns the LANGFLOW_AUTO_LOGIN setting off by default; IBM offers no workaround for servers that cannot upgrade. A public Metasploit Framework module already cites CVE-2026-93680 and can connect to a Langflow server's MCP endpoint without credentials to enumerate its tools, though neither critical flaw is in CISA's Known Exploited Vulnerabilities catalog as of its October 30 update.", "body_md": "Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, [IBM said last week](https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2).\n\nLangflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0.\n\nNeither flaw is in CISA’s Known Exploited Vulnerabilities catalog, as of the catalog’s October 30 update. Six other Langflow flaws are listed there, most recently CVE-2026-9198, which was [added in August](https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html).\n\nThe four Langflow flaws in IBM’s bulletin, first published on October 28 and updated the next day, are:\n\n| CVE | CVSS score (IBM) | Account needed | What IBM says it could allow | \n|---|---|---|---|\n| CVE-2026-93680 | 9.8 (Critical) | No | Bypassing security restrictions, because of improper authentication | \n| CVE-2026-110186 | 9.8 (Critical) | No | Running arbitrary code, because of improper control of code generation | \n| CVE-2026-110193 | 8.8 (High) | Yes, a low-privileged account | Making the Agentic Assistant generate or submit component code that runs operating system commands on the server | \n| CVE-2026-110192 | 6.5 (Medium) | Yes | Getting sensitive information from insufficiently protected credentials | \n\nOne of the flaws is “unauthenticated remote code execution exploitable through model context protocol tool enumeration,” according to IBM. Through the Model Context Protocol (MCP), Langflow can offer its flows as tools to AI apps that support MCP.\n\nA [module in the public Metasploit Framework](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680.rb) already cites CVE-2026-93680, the authentication bypass. It connects to a Langflow server’s MCP endpoint without credentials, starts a session, and lists the tools the server offers. It does not run code or commands on the server.\n\nIts author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM’s.\n\nWhen automatic login is enabled, Langflow logs users in as superusers without prompting them to sign in. The setting LANGFLOW_AUTO_LOGIN is enabled by default in [Langflow 1.12.8](https://github.com/langflow-ai/langflow/blob/v1.12.8/src/lfx/src/lfx/services/settings/auth.py). Its code description warns that it “bypasses authentication and should only be used in development environments.”\n\nThe module was tested on Langflow 1.8.4 with automatic login turned on. Another of the four flaws is “an incomplete remediation of an auto-login security control,” according to IBM. The bulletin does not say whether servers with automatic login turned off are vulnerable.\n\n### Upgrading to 1.13.0\n\n[Langflow 1.13.0](https://github.com/langflow-ai/langflow/releases/tag/v1.13.0) came out on October 22. Version 1.12.8, released the same day, still has the flaws, and PyPI lists no later 1.12 release as of November 2. IBM offers no workaround for servers that cannot upgrade yet.\n\nLangflow 1.13 turns automatic login off by default. To upgrade:\n\n1. Back up the database, the secret key and uploaded files.\n2. If the server uses automatic login, prepare the existing account for password sign-in, as [Langflow’s upgrade guidance](https://docs.langflow.org/get-started-installation) describes.\n3. Upgrade the Python package with pip install –upgrade “langflow==1.13.0”. For Docker, move to the langflowai/langflow:1.13.0 image and keep the deployment’s persistent data.\n4. If you cannot sign in after upgrading, follow the recovery steps that the same guidance links to. Do not delete or reinstall Langflow to get access back, because Langflow’s documentation warns this can permanently remove your flows.\n\nOn October 29, IBM also published CVE records for 29 other Langflow flaws and named versions [1.12.4](https://www.ibm.com/support/pages/node/7293015) and [1.12.5](https://www.ibm.com/support/pages/node/7293016) as their fixes. One of them, CVE-2026-104339, could also let an attacker with no account run arbitrary code, and IBM rates it 9.8. None of the 33 records, these four included, lists 1.13.0 as affected.", "url": "https://wpnews.pro/news/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers", "canonical_source": "https://www.swapupdate.in/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers/", "published_at": "2026-11-03 04:33:33+00:00", "updated_at": "2026-11-03 05:22:17.814154+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "agent-protocols", "ai-tools", "artificial-intelligence"], "entities": ["IBM", "Langflow", "CVE-2026-93680", "CVE-2026-110186", "CISA", "Metasploit Framework", "Model Context Protocol", "LANGFLOW_AUTO_LOGIN"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers", "markdown": "https://wpnews.pro/news/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers.md", "text": "https://wpnews.pro/news/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers.txt", "jsonld": "https://wpnews.pro/news/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers.jsonld"}}