Langflow Vulnerability: Critical Flaws CVE-2026-93680 and CVE-2026-110186 Let Attackers In Without a Login, Upgrade to 1.13.0
IBM says two critical Langflow flaws let attackers with no account bypass sign-in or run code on the server. Versions 1.0.0 through 1.12.8 are affected, there is no workaround, and the fix is 1.13.0.
Where Worldwide
On this page 8 sections
Langflow is the open-source tool many teams use to build AI agents and chatbots, and it has two critical flaws that IBM says let an attacker with no account get past sign-in or run code on the server. If your company runs any Langflow version from 1.0.0 through 1.12.8, the only fix is to upgrade to 1.13.0, and IBM lists no workaround.
What happened with the Langflow vulnerability
IBM published a security bulletin for Langflow OSS on Wednesday, October 28, 2026, and updated it on Thursday, October 29. It lists four Langflow flaws plus three in Hono, a web library that ships with Langflow. The fixed release, Langflow 1.13.0, came out on Thursday, October 22, 2026, according to PyPI.
Langflow is a visual builder. You drag components together to make AI workflows that call models, read documents and connect to other systems. That is exactly why a Langflow server is worth breaking into: it usually holds AI provider API keys and database passwords, and it can reach internal data.
The Langflow CVEs and how serious they are
| CVE | What IBM says it allows | Account needed? | IBM score |
|---|---|---|---|
| CVE-2026-93680 | Bypassing security restrictions due to improper authentication | No | 9.8 Critical |
| CVE-2026-110186 | Running arbitrary code due to improper control of code generation | No | 9.8 Critical |
| CVE-2026-110193 | A low-privileged user can make the Agentic Assistant generate or submit code that runs operating system commands on the server | Yes, low-privileged | 8.8 High |
| CVE-2026-110192 | Obtaining sensitive information due to insufficiently protected credentials | Yes | 6.5 Medium |
The three Hono flaws (CVE-2026-84363, CVE-2026-84364 and CVE-2026-84365) are rated 5.3 to 6.5. The upgrade covers everything in the bulletin.
What is confirmed and what is not
Confirmed from primary sources:
- IBM lists Langflow OSS 1.0.0 through 1.12.8 as affected, on Windows, Linux and macOS.
- The fix is 1.13.0. The bulletin's workaround section says none.
- A public Metasploit module named "Langflow AI Authentication Bypass" targets CVE-2026-93680. Its description says affected versions allow unauthenticated connections to the MCP endpoint, so an attacker can start a session and pull back privileged MCP-related information. From its code, it gathers information and does not run commands. It names 1.5.0 through 1.11.4 as affected, which is narrower than IBM's range. Go by IBM's range.
- In 1.12.8, the AUTO_LOGIN setting is on by default, and the code's own description warns that it "bypasses authentication and should only be used in development environments." Langflow 1.13 turns automatic login off by default.
Not known:
- IBM does not say whether these flaws are being exploited.
- IBM does not say whether turning off automatic login protects older versions. Do not treat that as a fix.
- IBM credits no researchers, and none of the sources we reviewed include a technical write-up of the code execution flaw, CVE-2026-110186.
Who is affected by the Langflow flaws
Any company running Langflow itself, whether on a developer laptop, a cloud server or a Docker container. The highest risk is:
- Instances reachable from the internet.
- Instances someone set up as an experiment and never shut down.
- Instances still using automatic login.
If you use a hosted product built on Langflow, the vendor has to patch. Ask them which version they run.
How to check your Langflow version and patch this week
| Step | How to do it |
|---|---|
| Find every instance | Search cloud accounts, Docker hosts and developer machines. Look for langflowai/langflow images in docker ps or compose files. |
| Check the version | Run pip show langflow, or read the Docker image tag. Anything from 1.0.0 through 1.12.8 is affected. |
| Limit exposure first | Put internet-facing instances behind a firewall or VPN until they are upgraded. This buys time; it is not a fix. |
| Back up | IBM advises backing up the database, the secret key and uploaded files. |
| Prepare sign-in | If the instance uses automatic login, Langflow's docs say to set up the existing account for password sign-in before upgrading. |
| Upgrade | pip install --upgrade "langflow==1.13.0", or switch to the langflowai/langflow:1.13.0 image and keep your persistent data. |
| If you get locked out | Follow Langflow's "Recover access after upgrading" steps. Its docs warn that deleting or reinstalling can permanently remove your flows. |
| Rotate secrets | As a precaution, if an instance was reachable from the internet while on an affected version, rotate the AI keys, database passwords and tokens it stored. |
| Skip pre-releases | PyPI also lists 1.13.1rc2 and 1.14.0 development builds. Those are pre-releases. Use 1.13.0 in production. |
Why this matters for a company network
AI tools often go live faster than anything else in a company. A team spins up Langflow to try an idea, connects it to a model provider and a company database, and moves on. Nobody adds it to the patch schedule, and it often keeps automatic login because that was the default.
Running code is Langflow's whole job, so authentication is the only thing between the internet and every key it holds. Once that fails, an attacker gets those keys and can reach whatever the server reaches. If you host tools like this yourself, they need the same inventory, patching and network rules as any other server. Our self-hosting infrastructure page covers how we set that up.
Langflow vulnerability questions people are asking
What version of Langflow fixes the critical flaws?
Langflow 1.13.0. IBM lists every version from 1.0.0 through 1.12.8 as affected.
Is Langflow 1.12.8 safe?
No. IBM's bulletin names 1.12.8 as the last affected version.
Is there a workaround if I cannot upgrade yet?
IBM lists none. Cutting the server off from the internet lowers the risk while you plan the upgrade, but it does not fix the flaws.
Are attackers exploiting the Langflow flaws?
IBM does not say. Public tooling for CVE-2026-93680 exists, so treat this as urgent.
Will upgrading to Langflow 1.13.0 lock me out?
It can, if you relied on automatic login, because 1.13 turns it off. Set a password on the existing account first. If you are already locked out, use Langflow's recovery steps and do not reinstall.
Does turning off AUTO_LOGIN fix the Langflow vulnerability?
Not confirmed. Turning it off is good practice, but the only fix IBM lists is 1.13.0.
I use a hosted service built on Langflow. What should I do?
Ask the provider which Langflow version they run and when they patched. Get the answer in writing.
The bigger lesson
AI tools are servers, and they hold some of the most valuable keys in your company. If a tool can run code and reach your data, it belongs in your inventory and on your patch schedule from the day someone installs it, not the day an advisory comes out.
See how we lock down systems like this at security hardening, or get a quote for a review of your AI and self-hosted tools.
Get security alerts like this by email, plus our free checklist, at security alerts.
Sources: IBM Security Bulletin: Langflow OSS affected by multiple vulnerabilities; Langflow 1.13.0 release notes; Langflow installation and upgrade docs; Langflow on PyPI; Langflow 1.12.8 auth settings; Metasploit Langflow auth bypass module.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Mittwald MCP Server Breach: An Attacker Used a Web Host's AI Assistant Connector to Compromise 56 Customer Projects, What Is Confirmed and What to Check
German web host Mittwald says an attacker got in through the MCP server customers use to connect AI assistants...
Jensen Huang Investigation: NVIDIA's Board Opens a Probe Into a Reported Foreign Intelligence Effort, What Is Confirmed and How to Protect Your Executives
NVIDIA's board has opened an independent investigation after reports that CEO Jensen Huang was a foreign intel...
Abe Office Malware: Signed Fake Helper Carries Code to Make Chrome Decrypt Its Own Cookies, What Is Confirmed and What to Check
A signed Windows trojan posing as an Abe Office helper carries code to make Chrome unlock its own protected co...
