IBM urges upgrade after critical Langflow authentication and code flaws
IBM has disclosed four vulnerabilities in Langflow, including two critical CVSS 9.8 flaws that could allow an unauthenticated remote attacker to bypass security restrictions or run arbitrary code on a server. The issues affect every Langflow release from 1.0.0 through 1.12.8, and IBM identifies version 1.13.0 as the only fix.
Langflow is an open-source platform for building AI agents and workflows. IBM’s bulletin, first published on October 28 and updated the following day, identifies CVE-2026-93680 as an improper-authentication issue and CVE-2026-110186 as improper control of code generation. Both require no account and carry a critical 9.8 CVSS score in IBM’s assessment.
Unauthenticated exposure through MCP
IBM describes one issue as unauthenticated remote code execution exploitable through Model Context Protocol tool enumeration. Langflow can expose flows as tools to AI applications that support MCP. A public Metasploit Framework module cites CVE-2026-93680 and can connect to a Langflow server’s MCP endpoint without credentials, create a session and enumerate the tools available from that server.
The module does not execute commands on the server. Its author tested it against Langflow 1.8.4 with automatic login enabled and lists versions 1.5.0 through 1.11.4 as affected. IBM’s affected range is broader, covering releases from 1.0.0 through 1.12.8.
The operational risk is sharpened by Monero mining on exposed AI endpoints involving Monero mining on exposed AI endpoints. Langflow’s LANGFLOW_AUTO_LOGIN setting is enabled by default in version 1.12.8; when it is enabled, users are logged in as superusers without a sign-in prompt. Its code description warns that the setting bypasses authentication and is intended only for development environments.
Four flaws and a required upgrade
IBM also assigned CVE-2026-110193 a high 8.8 score. A low-privileged account could use it to make the Agentic Assistant generate or submit component code that runs operating-system commands on the server. CVE-2026-110192, rated 6.5, could expose sensitive information through insufficiently protected credentials.
IBM describes another of the four flaws as an incomplete remediation of an auto-login security control, but its bulletin does not state whether installations with automatic login disabled remain vulnerable. As of CISA’s October 30 catalog update, neither critical issue appeared in the Known Exploited Vulnerabilities catalog. Six other Langflow vulnerabilities were listed there, most recently CVE-2026-9198, added in August.
Upgrade without removing persistent data
Langflow 1.13.0 was released on October 22 and changes automatic login to off by default. Version 1.12.8 was released the same day but still contains the flaws. IBM provides no workaround for systems that cannot upgrade.
Before upgrading, organizations should back up the database, secret key and uploaded files. Deployments using automatic login should prepare the existing account for password sign-in as described in Langflow’s upgrade guidance. Python installations can upgrade with pip install --upgrade "langflow==1.13.0"; Docker deployments should move to langflowai/langflow:1.13.0 while retaining persistent data.
If sign-in fails after the upgrade, Langflow directs administrators to its recovery steps. Its documentation warns against deleting or reinstalling the platform to restore access because that can permanently remove flows. The practical implication is to identify exposed Langflow servers, preserve their data, and schedule the 1.13.0 upgrade with account-access preparation rather than treating a reinstall as remediation.