Langflow critical auth bypass and RCE flaws, upgrade to 1.13.0

What happened

IBM published a bulletin on October 28, updated the next day, covering four flaws in Langflow, an open-source tool for building AI agents and workflows. Langflow’s vulnerability reports go to IBM, according to The Hacker News. CSO Online describes Langflow as now owned by IBM.

The four flaws are listed below with IBM’s CVSS scores as given by The Hacker News. CSO Online reports the same 9.8 and 6.5 scores but describes CVE-2026-110193 only as high severity, without a score.

• CVE-2026-93680, 9.8 critical, no account needed. It allows bypassing security restrictions because of improper authentication (The Hacker News). CSO Online says it stems from an incomplete remediation of a previous auto-login security issue and can give access to features that normally require authentication (CSO Online).
• CVE-2026-110186, 9.8 critical, no account needed. It allows running arbitrary code because of improper control of code generation (The Hacker News). CSO Online says it works through Model Context Protocol (MCP) tool enumeration (CSO Online). The Hacker News quotes IBM describing one flaw as “unauthenticated remote code execution exploitable through model context protocol tool enumeration”, but does not say which CVE that is (The Hacker News).
• CVE-2026-110193, high severity, requires a low-privileged account. The Hacker News lists IBM’s score as 8.8 and says it can make the Agentic Assistant generate or submit component code that runs operating system commands on the server (The Hacker News). CSO Online attributes it to an issue in a third-party library used by the Agentic Assistant (CSO Online).
• CVE-2026-110192, 6.5 medium, requires an account. It allows getting sensitive information from insufficiently protected credentials (The Hacker News). CSO Online describes these as API credentials (CSO Online).

On exploitation, neither critical flaw was in CISA’s Known Exploited Vulnerabilities catalog as of its October 30 update. Six other Langflow flaws are listed there, most recently CVE-2026-9198, added in August (The Hacker News). CSO Online notes that earlier Langflow flaws have been exploited in the wild to steal AI and developer credentials, most recently in August (CSO Online).

A module in the public Metasploit Framework cites CVE-2026-93680. It connects to a Langflow server’s MCP endpoint without credentials, starts a session and lists the server’s tools. It does not run code or commands on the server. It was tested on Langflow 1.8.4 with automatic login turned on (The Hacker News).

IBM also released fixes for three medium-severity flaws in Hono, a framework used inside Langflow for request routing and backend web server tasks, and advises upgrading Hono to 4.13.5. CVE IDs for the Hono flaws are not confirmed in the sources (CSO Online).

Separately, on October 29 IBM published CVE records for 29 other Langflow flaws, fixed in 1.12.4 and 1.12.5. One of these, CVE-2026-104339, is rated 9.8 and could also let an attacker with no account run arbitrary code. None of the 33 records lists 1.13.0 as affected (The Hacker News).

Am I affected?

• Affected versions: Langflow 1.0.0 through 1.12.8, according to IBM as reported by both The Hacker News and CSO Online. The Metasploit module’s author lists a narrower range, 1.5.0 through 1.11.4. IBM’s range is the broader one.
• 1.12.x is not a fix line: 1.12.8 was released on October 22, the same day as 1.13.0, and still has the flaws. As of November 2, PyPI listed no later 1.12 release. The 1.12.4 and 1.12.5 releases fix the other 29 flaws, not these four (The Hacker News).
• Automatic login: LANGFLOW_AUTO_LOGIN is enabled by default in 1.12.8 and logs users in as superusers without a sign-in prompt. Its code description says it “should only be used in development environments.” Whether servers with automatic login turned off are vulnerable is not confirmed, because the bulletin does not say (The Hacker News).
• Workaround: IBM offers no workaround for servers that cannot upgrade yet (The Hacker News).

What to do now

1. Back up the database, the secret key and uploaded files before upgrading (CSO Online, quoting IBM’s advisory).
2. If the server uses automatic login, prepare the existing account for password sign-in as described in Langflow’s upgrade guidance. Langflow 1.13 turns automatic login off by default (The Hacker News).
3. Upgrade to 1.13.0. For the Python package, run pip install --upgrade "langflow==1.13.0". For Docker, move to the langflowai/langflow:1.13.0 image and keep the deployment’s persistent data (The Hacker News).
4. If you cannot sign in after upgrading, follow the recovery steps linked from Langflow’s upgrade guidance. Do not delete or reinstall Langflow to regain access, because Langflow’s documentation warns this can permanently remove your flows (The Hacker News).
5. Upgrade Hono to 4.13.5 as IBM advises. How this applies to existing Langflow deployments is not confirmed in the sources (CSO Online).

Sources

• The Hacker News: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
• CSO Online: Critical Langflow flaws enable authentication bypass and RCE