Langflow flaws let attackers bypass authentication and run code; only 1.13.0 fixes them
IBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public Metasploit module already cites, and unauthenticated code execution through MCP tool enumeration. Upgrade to 1.13.0.
IBM published a security bulletin on October 28 for four flaws in Langflow, the open-source tool for building AI agents and workflows, affecting every release from 1.0.0 through 1.12.8. Two are rated 9.8: CVE-2026-93680, an improper authentication flaw that lets a remote attacker bypass security restrictions, and CVE-2026-110186, arbitrary code execution through improper control of code generation. IBM's summary also describes an incomplete fix for an auto-login control, exposure of operator-injected API keys, and unauthenticated remote code execution "exploitable through model context protocol tool enumeration." A public Metasploit module already cites CVE-2026-93680 and lists a server's MCP tools without credentials, The Hacker News reported. The only fix is Langflow 1.13.0, released October 22, and IBM offers no workaround.
Why it matters
Langflow's automatic login signs users in as superusers without a password, and The Hacker News found it enabled by default in 1.12.8, whose own code says it "should only be used in development environments." An agent builder that publishes its flows as MCP tools is an identity boundary: whoever can call those tools acts with every credential the flows hold. Six other Langflow flaws are already in CISA's Known Exploited Vulnerabilities catalog, so this product is on attackers' lists.
Upgrade to 1.13.0, and if the server relied on auto-login, set up password sign-in first as Langflow's upgrade guidance describes. Keep Langflow and its MCP endpoint off the internet, and rotate provider keys stored in any instance that was reachable. Our guide to securing AI agent identities and the MCP authorization entry cover how agent tools should authenticate callers.
Source: IBM security bulletin
Related on Start with Identity
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- BlogHPE fixes three ArubaOS authentication bypass flaws among eight maximum-severity bugs
HPE patched 72 ArubaOS vulnerabilities, eight of them maximum severity, including authentication bypasses CVE-2026-79844 and CVE-2026-79845 in AOS-10 and CVE-20
- BlogOkta Access Gateway flaw lets an admin run system commands as the gateway's service account
Okta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute syst
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVEFortinet administrative FortiCloud SSO authentication bypass across accounts
An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos