Langflow Vulnerabilities: Critical RCE Flaws

Langflow users should update their installations immediately after IBM disclosed four security vulnerabilities affecting the open-source AI workflow platform. Two of the flaws are critical and could allow remote attackers to bypass authentication or execute arbitrary code on vulnerable servers without having an account.
The vulnerabilities affect Langflow versions 1.0.0 through 1.12.8. IBM recommends upgrading to Langflow 1.13.0, which disables automatic login by default. No alternative workaround is provided for systems that cannot be upgraded.

---

🔴 Langflow Security Vulnerabilities​

IBM's security advisory, published on October 28, 2026, and updated the following day, identifies four vulnerabilities with different severity levels.

CVE ID	CVSS Score	Severity	Description
CVE-2026-93680	9.8	Critical	Authentication bypass without requiring an account.
CVE-2026-110186	9.8	Critical	Unauthenticated arbitrary code execution.
CVE-2026-110193	8.8	High	Low-privileged users may trigger code execution through the Agentic Assistant.
CVE-2026-110192	6.5	Medium	Authenticated users may access sensitive information due to insufficient credential protection.

The two critical vulnerabilities are particularly dangerous because they can be exploited without prior authentication, significantly reducing the barriers an attacker must overcome.

---

⚠️ Exploitation Through Model Context Protocol (MCP)​

IBM described an unauthenticated remote code execution vulnerability that can be exploited through Langflow's Model Context Protocol (MCP) endpoints.
MCP allows compatible AI applications to access Langflow workflows and use them as tools. However, weaknesses in authentication may allow attackers to interact with MCP endpoints without providing valid credentials.
The Metasploit Framework already includes a module referencing CVE-2026-93680.
The module can:

• Connect to a Langflow MCP endpoint without authentication.
• Establish a session.
• Enumerate the tools exposed by the server.

Important: The documented Metasploit module does not execute commands or arbitrary code on the server. Its confirmed functionality is limited to discovering available tools.
The module identifies Langflow versions 1.5.0 through 1.11.4 as affected, which is narrower than IBM's reported range of 1.0.0 through 1.12.8.

---

🔐 Automatic Login Increases Security Risks​

One important part of the security issue involves Langflow's automatic login feature.
When enabled, this feature allows users to access the platform with Superuser privileges without providing normal authentication credentials.
The LANGFLOW_AUTO_LOGIN setting was enabled by default in version 1.12.8.
Langflow's source code warns that this feature bypasses authentication and should only be used in development environments.
IBM also identified another vulnerability involving an incomplete fix for a previous issue related to automatic login controls.
However, the advisory does not clarify whether disabling automatic login completely protects installations from the reported vulnerabilities.

---

🛠️ How to Fix the Langflow Vulnerabilities​

IBM recommends upgrading to Langflow 1.13.0, released on October 22, 2026.
Version 1.13.0 disables automatic login by default and is not listed among the affected versions in IBM's advisory.
Before upgrading, follow these steps:
1. Back up your data.
Create backups of your database, secret key, and uploaded user files.
2. Prepare your authentication credentials.
If your installation relies on automatic login, make sure you have a valid password before upgrading.
3. Upgrade Langflow using pip.
Run the following command:

pip install --upgrade langflow==1.13.0

4. Update Docker installations.
If you use Docker, switch to the updated image:

langflowai/langflow:1.13.0

Make sure persistent data is preserved during the upgrade.
5. Verify access after upgrading.
If you cannot log in, follow Langflow's official account recovery instructions. Avoid deleting or reinstalling the platform without checking the recovery procedures, as this could permanently destroy saved workflows.
IBM does not provide an alternative mitigation for systems that cannot be upgraded. Therefore, updating should be a priority, especially for installations exposed to untrusted networks.

---

📌 Additional Langflow Vulnerabilities​

On October 29, IBM also published records covering 29 additional Langflow vulnerabilities, identifying versions 1.12.4 and 1.12.5 as releases that addressed those issues.
One notable example is CVE-2026-104339, which could allow an unauthenticated attacker to execute arbitrary code remotely. It also received a critical CVSS score of 9.8.
According to the published information, none of the 33 vulnerability records, including the four vulnerabilities discussed above, lists version 1.13.0 as affected.

---

🛡️ Security Recommendations​

If you operate a Langflow installation, take the following precautions:

• Check your installed Langflow version.
• Upgrade to version 1.13.0.
• Verify that LANGFLOW_AUTO_LOGIN is disabled.
• Restrict access to Langflow interfaces, especially MCP endpoints.
• Review server logs for unusual connections and unauthorized access attempts.
• Back up your database, secret key, and uploaded files before upgrading.

Bottom line: The combination of authentication bypass and potential remote code execution makes these vulnerabilities a serious risk for exposed Langflow installations. Upgrading to version 1.13.0 is IBM's recommended solution.