Two severe security flaws found in Langflow – an open-source framework for building AI agents and automated workflows – permit attackers without any account to bypass login or execute arbitrary code on servers. These bugs affect all versions from 1.0.0 through 1.12.8. Patching to version 1.13.0 is the only full remedy.
What’s at Risk
IBM, which reported the defects, discovered four distinct vulnerabilities in Langflow that vary in severity and required access levels. Two are rated at the highest Critical level (CVSS 9.8), both not requiring any credentials. These include CVE-2026-93680, which lets attackers bypass security without logging in, and CVE-2026-110186, enabling unauthenticated remote code execution through poor control over code generation.
Additional flaws require low-privilege or authenticated access. CVE-2026-110193allows a low-privileged user to send component code that triggers OS-level commands. CVE-2026-110192exposes sensitive credentials due to weak credential protection. These are rated High (8.8) and Medium (6.5) respectively.
Specifics and Exploitation Paths
One of the unauthenticated flaws involves Langflow’s Model Context Protocol (MCP). Via MCP, Langflow can expose its flows as tools to compatible AI applications. Attackers exploiting CVE-2026-93680can connect to the MCP tool-enumeration endpoint without credentials and list available tools, though they can’t immediately execute code via that path. Exploits for versions between 1.5.0 and 1.11.4 are listed in public attack tools.
A key factor making attacks worse: the setting LANGFLOW_AUTO_LOGINis enabled by default in version 1.12.8, automatically signing any visitor in as an admin. IBM describes this as an “incomplete remediation” of earlier auto-login security problems, and notes that servers running this setting are especially at risk. Servers without this default and with authentication enabled may or may not be vulnerable, though IBM doesn’t confirm.
How to Fix It
Langflow 1.13.0, released on October 22, fully addresses these flaws. It turns off auto-login by default, among other fixes. Users on 1.12.8 or earlier are urged to upgrade immediately. For Docker deployments, switching to the langflowai/langflow:1.13.0image is advised.
Backup of the database, secret keys, and uploaded files is essential before upgrading. For servers that employed auto-login, admins should configure accounts for password-sign-in. If access issues arise post-upgrade, recovery steps are documented—users are warned against deleting or reinstalling Langflow, which could lead to permanent loss of AI workflow data.
Other Related Flaws
Besides these four, IBM added 29 more Langflow vulnerabilities in a record published on October 29. Among them, CVE-2026-104339also allows unauthenticated remote code execution, again at critical severity (9.8). None of the 33 recorded flaws, including these latest ones, list version 1.13.0 as affected.
As of the October 30 update, these new flaws have not yet been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. The organization had already listed six Langflow vulnerabilities there, most recently one added in August.
Why this matters:Langflow is widely adopted in AI research, agent workflows, and infrastructure supporting AI-enhanced tools. Flaws allowing unauthenticated code execution can lead to full system compromise, data exfiltration, or lateral moves inside critical environments where Langflow serves as a component.
Analytical takeaway:These vulnerabilities illustrate how non-production configurations (like auto-login) morphed into live threats. Moving forward, AI workflow tools must adopt security-first defaults, rigorous credential controls, and transparent vulnerability tracking. Users should view version 1.13.0 not as optional, but essential. Monitoring whether organizations behind Langflow labs build stronger commit hygiene and whether CISA updates its KEV list will be important to gauge systemic risk.
