CVE-2026-93680: Langflow OSS is affected by multiple vulnerabilities

What it is

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

Description quoted from the CVE record (assigned by ibm, published 2026-10-29).

Weakness: CWE-287 Improper Authentication

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 1 Metasploit module and 6 code repositories naming this CVE.

• Metasploit module

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 9 references on Exploit Observer

Live scores

EPSS

0.022
some chance of attack soon

VEDAS

0.978
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Nuclei · Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

• https://www.ibm.com/support/pages/node/7294467 (vendor-advisory, patch)

How to detect it

Nuclei template (active check)

Langflow - Unauthenticated MCP SSE Endpoint Access

Langflow 1.5.0 through 1.11.4 allows unauthenticated connections to the Model Context Protocol (MCP) Server-Sent Events endpoint at `/api/v1/mcp/sse`. Without any credentials a remote attacker can open the SSE stream, receive a valid MCP session endpoint (`/api/v1/mcp/?session_id=<uuid>`), initialize an MCP session, and enumerate the exposed MCP tools and their metadata. A public Metasploit module and proof-of-concept exploit abuse this missing authentication to harvest MCP information from exposed instances.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /api/v1/mcp/sse); it decides using status, word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-93680.yaml

id: CVE-2026-93680

info:
  name: "Langflow - Unauthenticated MCP SSE Endpoint Access"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Langflow 1.5.0 through 1.11.4 allows unauthenticated connections to the Model Context Protocol (MCP)
    Server-Sent Events endpoint at `/api/v1/mcp/sse`. Without any credentials a remote attacker can open the
    SSE stream, receive a valid MCP session endpoint (`/api/v1/mcp/?session_id=<uuid>`), initialize an MCP
    session, and enumerate the exposed MCP tools and their metadata. A public Metasploit module and
    proof-of-concept exploit abuse this missing authentication to harvest MCP information from exposed
    instances.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-93680&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=langflow&match=exact
  classification:
    cve-id: CVE-2026-93680
    cwe-id: CWE-306
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,langflow,auth-bypass,mcp,unauth,exposure

http:
  - raw:
      - |
        GET /api/v1/mcp/sse HTTP/1.1
        Host: {{Hostname}}
        Accept: text/event-stream
        Cache-Control: no-cache

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "text/event-stream"

      - type: word
        part: body
        words:
          - "session_id="
          - "/api/v1/mcp/"
        condition: and

      - type: status
        status:
          - 200

CVE-2026-93680.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-93680 Langflow - Unauthenticated MCP SSE Endpoint Access. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-93680 Langflow - Unauthenticated MCP SSE Endpoint Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/mcp/sse"; nocase; fast_pattern; http.header; content:"text/event-stream"; nocase; classtype:attempted-recon; reference:cve,CVE-2026-93680; reference:url,https://www.exploit.observer/?keyword=CVE-2026-93680&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=langflow&match=exact; sid:1091802; rev:1;)

CVE-2026-93680.rules on GitHub

Advisories on this CVE

• Langflow critical auth bypass and RCE flaws, upgrade to 1.13.0 (full advisory)

References

Vendor advisories and patches

• https://www.ibm.com/support/pages/node/7294467 (vendor-advisory, patch)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.