NEWS

Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

IBM disclosed two CVSS 9.8 Langflow flaws allowing auth bypass and remote code execution in releases 1.0.0 through 1.12.8. Upgrade to 1.13.0.

Dylan H.

News Desk

November 2, 2026
2 min read
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

Overview

IBM, which handles vulnerability reports for the open-source AI agent builder Langflow, disclosed two critical flaws that let a remote attacker with no account bypass authentication or execute arbitrary code. Every release from 1.0.0 through 1.12.8 is affected. The fix is in 1.13.0, released October 22, 2026. IBM offers no workaround for servers that cannot upgrade.

Vulnerabilities

IBM's bulletin was published October 28 and updated October 29.

CVECVSSAccount NeededImpact
CVE-2026-936809.8NoImproper authentication; bypass of security restrictions
CVE-2026-1101869.8NoImproper control of code generation; arbitrary code execution
CVE-2026-1101938.8Low-privilegedAgentic Assistant can generate component code that runs OS commands
CVE-2026-1101926.5YesExposure of insufficiently protected credentials

One critical flaw is unauthenticated RCE reachable through Model Context Protocol (MCP) tool enumeration. The other is described as an incomplete fix for an auto-login control. The LANGFLOW_AUTO_LOGIN setting signs users in as superusers without a prompt and is enabled by default in 1.12.8. IBM does not say whether servers with auto-login disabled are vulnerable.

Exploitation Status

  • Neither critical flaw is in CISA's KEV catalog as of the October 30 update, though six other Langflow flaws are
  • A public Metasploit module cites CVE-2026-93680; it lists MCP tools without credentials but does not run code. Its author lists 1.5.0 through 1.11.4 as affected, narrower than IBM's range
  • On October 29, IBM published 29 more Langflow CVEs fixed in 1.12.4 and 1.12.5, including CVE-2026-104339 (9.8, unauthenticated code execution). None of the 33 records lists 1.13.0 as affected

Recommended Actions

  1. Back up the database, secret key, and uploaded files
  2. If you rely on auto-login, prepare the existing account for password sign-in first, per Langflow's upgrade guidance
  3. Upgrade with pip install --upgrade "langflow==1.13.0" or move to the langflowai/langflow:1.13.0 image, keeping persistent data
  4. Do not delete or reinstall Langflow if sign-in fails; this can permanently remove flows. Use the documented recovery steps
  5. Until patched, keep Langflow off the public internet

Sources