**IBM** recently issued a security bulletin detailing two critical vulnerabilities in **Langflow**, a popular open-source platform designed for building AI agents and workflows. These flaws, identified as **CVE-2026-93680** and **CVE-2026-110186**, carry a **CVSS** score of 9.8 (Critical) and allow for unauthenticated authentication bypass and remote code execution, respectively. ### Widespread Impact Across Langflow Versions The vulnerabilities affect all **Langflow** releases from version 1.0.0 up to and including 1.12.8. The only available fix is to upgrade to version 1.13.0. While these specific flaws are not yet listed in **CISA**'s Known Exploited Vulnerabilities catalog, six other **Langflow** flaws, including **CVE-2026-9198**, have previously been added. **IBM**'s bulletin, initially published on October 28 and updated the following day, details four **Langflow** vulnerabilities: | CVE | CVSS score (IBM) | Account needed | What IBM says it could allow | | :--------------- | :--------------- | :---------------------- | :--------------------------------------------------------------------------------------------------------------------------- | | **CVE-2026-93680** | 9.8 (Critical) | No | Bypassing security restrictions, because of improper authentication | | **CVE-2026-110186**| 9.8 (Critical) | No | Running arbitrary code, because of improper control of code generation | | **CVE-2026-110193**| 8.8 (High) | Yes, a low-privileged account | Making the Agentic Assistant generate or submit component code that runs operating system commands on the server | | **CVE-2026-110192**| 6.5 (Medium) | Yes | Getting sensitive information from insufficiently protected credentials | ### Unauthenticated RCE and Authentication Bypass Explained One of the most severe flaws, **CVE-2026-110186**, is described as an "unauthenticated remote code execution exploitable through model context protocol tool enumeration." This means that an attacker can leverage the **Model Context Protocol (MCP)**, which **Langflow** uses to offer its flows as tools to other AI applications, to execute arbitrary code without any authentication. The authentication bypass vulnerability, **CVE-2026-93680**, already has a module available in the public **Metasploit Framework**. This module demonstrates how to connect to a **Langflow** server's **MCP** endpoint without credentials, initiate a session, and enumerate the tools offered by the server. While this specific **Metasploit** module does not execute code or commands, it confirms the ease of bypassing authentication. Its author notes a slightly narrower affected range (1.5.0 through 1.11.4) than **IBM**'s broader assessment. ### The Peril of Automatic Login A key contributing factor to these vulnerabilities is the `LANGFLOW_AUTO_LOGIN` setting, which, until version 1.13.0, was enabled by default in **Langflow**. This setting automatically logs users in as superusers without requiring credentials, a feature explicitly warned against for production environments. **IBM** also highlighted an "incomplete remediation of an auto-login security control" as another flaw, though it did not specify if servers with automatic login disabled are entirely immune to the other vulnerabilities. ### Urgent Upgrade to 1.13.0 **Langflow** version 1.13.0, released on October 22, addresses these critical vulnerabilities by disabling automatic login by default and implementing the necessary fixes. Version 1.12.8, released on the same day, still contains the flaws, and no intermediate fixes are available. **IBM** has not provided workarounds for environments unable to upgrade immediately. To upgrade to version 1.13.0: 1. **Backup:** Create backups of your database, secret key, and any uploaded files. 2. **Password Preparation:** If your server utilizes automatic login, prepare existing accounts for password-based sign-in as described in **Langflow**'s upgrade guidance. 3. **Upgrade:** Execute `pip install --upgrade "langflow==1.13.0"` for Python package installations. For Docker deployments, switch to the `langflowai/langflow:1.13.0` image while preserving persistent data. 4. **Recovery:** If you encounter sign-in issues post-upgrade, follow the provided recovery steps. Crucially, do not delete or reinstall **Langflow** to regain access, as this can lead to permanent data loss of your flows. On October 29, **IBM** also published **CVE** records for an additional 29 **Langflow** flaws, with versions 1.12.4 and 1.12.5 identified as their respective fixes. Among these, **CVE-2026-104339** also enables unauthenticated arbitrary code execution and is rated 9.8 (Critical). None of the 33 **CVE** records, including the four discussed here, list version 1.13.0 as affected, reinforcing the urgency of upgrading.