AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-93680criticalCode execution2026-10-29

CVE-2026-93680 and CVE-2026-110186: IBM fixes a 9.8 authentication bypass and unauthenticated code execution in Langflow up to 1.12.8, upgrade to 1.13.0

IBM security bulletin 7294467 (first published 28 October 2026) says Langflow OSS 1.0.0 through 1.12.8 has two critical flaws an unauthenticated attacker can reach: an improper-authentication bypass and a code-injection bug that leads to code execution. It also fixes a low-privilege path to OS command execution through the Agentic Assistant and a credential exposure. Version 1.13.0 fixes all of them, so even instances patched to 1.12.5 last week need another upgrade.

01.

What it is

CVE-2026-93680 (CVSS 9.8, CWE-287): a remote attacker can bypass security restrictions because of improper authentication. IBM's summary describes it as an incomplete fix of the auto-login control.

CVE-2026-110186 (9.8, CWE-94): a remote attacker can run arbitrary code because of improper control of code generation. IBM's summary says unauthenticated code execution is reachable through MCP tool enumeration.

CVE-2026-110193 (8.8): a user with a low-privileged account can get the Agentic Assistant to generate or submit component code that uses unblocked patterns, which runs OS commands on the server.

CVE-2026-110192 (6.5, CWE-522): an authenticated attacker can obtain credentials that aren't protected well enough.

The same bulletin also bumps the Hono dependency for CVE-2026-84363, CVE-2026-84364 and CVE-2026-84365.

02.

How to check

  1. Run pip show langflow (or check the image tag of your langflowai/langflow container). Anything from 1.0.0 to 1.12.8 is affected.
  2. Find Langflow instances that can be reached from the internet or by untrusted users, especially ones with auto-login enabled or MCP servers exposed.
  3. Review server logs for unexpected component code changes, new API keys or unknown flows created since mid-October.
03.

How to fix

  1. Upgrade to Langflow 1.13.0. IBM lists no workaround for these four CVEs.
  2. Until you can upgrade, keep Langflow off the public internet and behind your own authentication.
  3. Rotate API keys and provider credentials stored in Langflow if the instance was exposed.
pip install --upgrade "langflow==1.13.0"
# or, for Docker
docker pull langflowai/langflow:1.13.0
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.