IBM just published details on two critical flaws in Langflow, an open-source tool for building AI agents and workflows, and the combination is about as bad as it gets. An attacker with no account can either bypass authentication entirely or run arbitrary code on the server.

Every release from 1.0.0 through 1.12.8 carries the flaws. The only fix is version 1.13.0.

The Four Flaws in the Bulletin

IBM's bulletin, first published on October 28 and updated the next day, covers four vulnerabilities. Two are critical, and both are unauthenticated.

One of these is described by IBM as "unauthenticated remote code execution exploitable through model context protocol tool enumeration." That sentence matters, because MCP is how Langflow offers its flows as tools to AI applications that support the protocol.

The MCP Attack Surface

Through the Model Context Protocol, Langflow can expose its workflows as callable tools to AI apps. That is a useful feature for anyone building agentic systems. It is also a public endpoint that, in vulnerable versions, does not require credentials to interact with.

A module in the public Metasploit Framework already cites CVE-2026-93680, the authentication bypass. It connects to a Langflow server's MCP endpoint without credentials, starts a session, and lists the tools the server offers.

The module does not run code or commands on the server. It enumerates. But enumeration is the reconnaissance step before exploitation, and the existence of a Metasploit module means the barrier to entry just dropped significantly.

The module's author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM's 1.0.0 through 1.12.8.

The Auto-Login Problem

Here is where the deployment configuration matters more than the CVE.

When automatic login is enabled, Langflow logs users in as superusers without prompting them to sign in. The setting LANGFLOW_AUTO_LOGIN is enabled by default in Langflow 1.12.8.

The code description for that setting is unusually blunt. It warns that it "bypasses authentication and should only be used in development environments."

The Metasploit module was tested on Langflow 1.8.4 with automatic login turned on. IBM describes one of the four flaws as "an incomplete remediation of an auto-login security control."

The bulletin does not say whether servers with automatic login turned off are vulnerable. That is a meaningful gap. If you disabled auto-login, you may not be exposed to that specific path, but you cannot assume you are safe without checking the version.

Upgrading to 1.13.0

Langflow 1.13.0 came out on October 22. Version 1.12.8, released the same day, still carries the flaws, and PyPI lists no later 1.12 release as of November 2. IBM offers no workaround for servers that cannot upgrade yet.

Langflow 1.13 turns automatic login off by default. That is a welcome default change, but it means the upgrade can lock you out if you were relying on auto-login.

The upgrade steps matter, and so does the order.

• Back up the database, the secret key, and uploaded files. This is not optional.
• If the server uses automatic login, prepare the existing account for password sign-in. Langflow's upgrade guidance walks through this.
• Upgrade the Python package with pip install --upgrade "langflow==1.13.0". For Docker, move to the langflowai/langflow:1.13.0 image and keep the deployment's persistent data.
• If you cannot sign in after upgrading, follow the recovery steps in the same guidance. Do not delete or reinstall Langflow to get access back. The documentation warns that this can permanently remove your flows.

That last warning is worth repeating because it is a real trap. Reinstalling to fix a login problem can destroy the workflows you built.

The Other 29 Flaws

On October 29, IBM also published CVE records for 29 additional Langflow flaws, naming versions 1.12.4 and 1.12.5 as their fixes.

One of them, CVE-2026-104339, could also let an attacker with no account run arbitrary code, and IBM rates it 9.8. None of the 33 records, including the four in this bulletin, lists 1.13.0 as affected.

Exploitation Status

Neither CVE-2026-93680 nor CVE-2026-110186 is in CISA's Known Exploited Vulnerabilities catalog as of the October 30 update.

That does not mean nobody has tried. Six other Langflow flaws are already in that catalog, most recently CVE-2026-9198, which was added in August. Langflow has been a target, and the existence of a Metasploit module for the auth bypass suggests the reconnaissance phase is already underway.

FAQ

What is CVE-2026-93680?

It is a critical (9.8) authentication bypass in Langflow. An attacker with no account can get past security restrictions, and a public Metasploit module already enumerates MCP tools through it.

What is CVE-2026-110186?

It is a critical (9.8) code generation flaw that lets an unauthenticated attacker run arbitrary code on the Langflow server.

Is auto-login the actual problem?

Partly. Langflow's LANGFLOW_AUTO_LOGIN setting is enabled by default in 1.12.8, and it logs users in as superusers without a prompt. The code itself warns it should only be used in development. Version 1.13.0 turns it off by default.

Does upgrading to 1.13.0 break anything?

It can. Turning off auto-login means you need a working password account. Back up the database, the secret key, and uploaded files first, and prepare the existing account for password sign-in before you upgrade.

Can I just reinstall Langflow if I get locked out?

No. Langflow's documentation warns that deleting or reinstalling to regain access can permanently remove your flows. Follow the recovery steps in the upgrade guidance instead.

Has this been exploited in the wild?

Neither of the two critical flaws is in CISA's KEV catalog as of October 30. But six other Langflow flaws are listed there, and a Metasploit module for the auth bypass is already public.

Source: The Hacker News