Skip to content
AI Security Wire

Published

- 4 min read

By

Langflow 1.13.0 Fixes Two 9.8 Flaws: Auth Bypass and Code Execution

langflow cve authentication-bypass ai-workflow patch
img of Langflow 1.13.0 Fixes Two 9.8 Flaws: Auth Bypass and Code Execution

Langflow has another round of critical fixes. IBM published a security bulletin for Langflow OSS on 28 October (modified 29 October) covering seven CVEs, and two of them carry a CVSS 3.1 score of 9.8. The fix is Langflow 1.13.0. Affected versions run from 1.0.0 through 1.12.8, and IBM lists no workaround.

The two critical flaws

CVE-2026-93680 is an improper authentication bug. IBM’s summary says a remote attacker can bypass security restrictions. IBM, as CNA, scores it 9.8 with a vector of network access, low complexity, no privileges and no user interaction. NVD published the record on 29 October, lists IBM’s score as a Secondary source and has not added its own. Separately, IBM’s summary mentions an incomplete remediation of an auto-login control, but it does not say which CVE that applies to.

CVE-2026-110186 is described as improper control of code generation, allowing a remote attacker to execute arbitrary code. It has the same 9.8 score and the same vector, again supplied by IBM.

Both scores come from IBM acting as the CNA. CVE-2026-110186 is scored as code execution with no privileges required on its own, so no chain is needed to reach the worst case. IBM’s summary also names unauthenticated remote code execution through model context protocol (MCP) tool enumeration, without mapping it to a specific CVE. IBM does not say the two flaws chain.

The rest of the bulletin

Five more CVEs sit in the same bulletin:

  • CVE-2026-110193 (8.8, IBM): a low-privileged authenticated user can get the Agentic Assistant to generate or submit component code that runs OS commands on the server.
  • CVE-2026-110192 (6.5, IBM): an authenticated attacker can read insufficiently protected credentials. IBM’s summary points to API key exposure, a link we infer from the summary rather than the CVE text.
  • CVE-2026-84363, 84364 and 84365 (5.9, 5.3 and 6.5, GitHub): flaws in the bundled Hono web framework, fixed in Hono 4.13.5. Reach is narrower than the scores suggest: 84364 only applies with dot-notation parsing enabled, which is off by default, and 84365 affects build-time static site generation only.

The Agentic Assistant item is the one to read twice if you run Langflow with shared access. It is a reminder that an AI feature that writes code is also a path to server-side execution.

Exploitation status

IBM’s bulletin does not say whether any of these are exploited. No evidence of in-the-wild exploitation found as of 3 November 2026 in the IBM bulletin, the NVD records, the CISA KEV feed released 30 October or Rapid7’s wrap-up. The KEV feed does list six earlier entries whose product field matches Langflow (the latest added on 4 August 2026, CVE-2026-9198), so the product has a history of exploitation. That history is context, not evidence about these two CVEs.

Rapid7’s Metasploit wrap-up dated 23 October, five days before IBM’s bulletin, lists a new auxiliary module, “Langflow AI Authentication Bypass (CVE-2026-93680)”, and says it covers Langflow 1.5.0 through 1.11.4. That is the module’s stated range, not a disagreement with IBM’s 1.0.0 to 1.12.8. A podcast write-up dated 3 November adds that the module enumerates tools through an MCP endpoint; that detail comes from that single secondary source. Our assessment: with a public module out, expect scanning of exposed instances.

What to do

  1. Upgrade to 1.13.0 (pip install langflow==1.13.0 or the langflowai/langflow:1.13.0 image).
  2. Before upgrading, back up the database, secret key and uploaded files. If you use automatic login, prepare the existing account for password sign-in first, per IBM’s instructions.
  3. Until you can patch, take Langflow off the public internet and put it behind your VPN or an authenticating proxy. IBM offers no workaround, so this is our guidance, not IBM’s.
  4. Our guidance: rotate any API keys stored in Langflow flows if the instance was exposed, given the credential-exposure CVE.

References

Frequently Asked Questions

Which Langflow versions are affected and what is the fix?
IBM's bulletin lists Langflow OSS 1.0.0 through 1.12.8 as affected and 1.13.0 as the fixed release. IBM says there are no workarounds, so upgrading is the only remediation it offers. Back up the database, secret key and uploaded files first, and note that deployments using automatic login need extra preparation before the upgrade.
Are these Langflow flaws being exploited?
No evidence found as of 3 November 2026 in IBM's bulletin, the NVD records or the CISA Known Exploited Vulnerabilities feed released 30 October, which lists neither CVE-2026-93680 nor CVE-2026-110186. Rapid7's 23 October Metasploit wrap-up lists a public auxiliary module for CVE-2026-93680. A public module raises the practical risk, but it is not evidence of exploitation.
Why does the CVSS score come from IBM and not NVD?
NVD shows both CVEs as Analyzed, but the 9.8 scores are published by IBM's PSIRT as the CNA, listed as a Secondary source. We quote them as IBM's scores. Check whether your own deployment is reachable from the network, since the vector is network, no privileges, no user interaction.