# Langflow, a Popular AI-Agent Builder, Has Two Critical Flaws Open to Attackers With No Account; the Only Fix Is Version 1.13.0

Times of AI Desk · 2026-11-03 · Security

[https://timesof.ai/2026/11/langflow-critical-unauthenticated-rce-auth-bypass-1-13-0](https://timesof.ai/2026/11/langflow-critical-unauthenticated-rce-auth-bypass-1-13-0)

> IBM, which handles Langflow's vulnerability reports, says every release from 1.0.0 through 1.12.8 has two critical flaws, rated 9.8, that could let an attacker with no account bypass authentication or run code, plus two lesser ones. The only fix is Langflow 1.13.0, released October 22, and there is no workaround. A public Metasploit module already cites the authentication bypass. Neither critical flaw was in CISA's exploited-vulnerabilities catalog as of October 30.

Anyone running a Langflow server older than 1.13.0 should treat it as exposed: IBM says the two worst flaws in its latest bulletin need no account to use, and there is no stopgap short of upgrading. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to **IBM**, which first published the bulletin on **October 28**. The Hacker News reported it on **Monday, November 2**.

## The four flaws

IBM lists four Langflow flaws affecting every release from **1.0.0 through 1.12.8**:

- **CVE-2026-93680**, rated 9.8 (critical): an attacker with no account could bypass security restrictions because of improper authentication.
- **CVE-2026-110186**, rated 9.8 (critical): an attacker with no account could run arbitrary code.
- **CVE-2026-110193**, rated 8.8 (high): an attacker with a low-privileged account could get Langflow's Agentic Assistant to produce code that runs operating-system commands on the server.
- **CVE-2026-110192**, rated 6.5 (medium): a signed-in attacker could obtain sensitive credentials.

IBM's summary describes the issues as including "an incomplete remediation of an auto-login security control" and "unauthenticated remote code execution exploitable through model context protocol tool enumeration." Through the Model Context Protocol, Langflow can offer its flows as tools to other AI apps, the kind of agent-to-agent connection where [trust-boundary bugs have turned up before](https://timesof.ai/2026/10/mcp-protocol-pivoting-cross-agent-ssrf). The bulletin lists the scores as IBM's own; we found no GitHub security advisory ids for these four.

## What is known about attacks

According to The Hacker News, neither critical flaw was in CISA's Known Exploited Vulnerabilities catalog as of the catalog's October 30 update, though six older Langflow flaws are. It reports that a module in the public Metasploit Framework already cites CVE-2026-93680 and connects to a Langflow server without credentials to list the tools it offers, without running code. The module's author lists a narrower affected range, 1.5.0 through 1.11.4, than IBM does.

## What to do

IBM's remedy is to upgrade to **Langflow 1.13.0**, released October 22, and it says there are no workarounds or mitigations. It advises backing up the database, the secret key and uploaded files first. The Hacker News notes that 1.13 turns automatic login off by default, so deployments that rely on it need to set up password sign-in before upgrading, following Langflow's upgrade guidance. Version 1.12.8, released the same day as 1.13.0, still has the flaws.

The Hacker News also reports that on October 29 IBM published records for 29 other Langflow flaws fixed in 1.12.4 and 1.12.5, including another 9.8-rated flaw, CVE-2026-104339, that could let an attacker with no account run code.

## Limits

- The bulletin does not say whether servers with automatic login turned off are exposed to every flaw.
- No confirmed exploitation in the wild has been reported for the four flaws; the Metasploit module only lists tools.
- The severity scores are IBM's, as the CVE numbering authority for Langflow. We have left out technical detail on how the flaws work.

## Sources

- [IBM: Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (October 28, 2026)](https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2)
- [The Hacker News: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers (November 2, 2026)](https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html)