Analysis
Langflow fixes two critical flaws rated 9.8, including an authentication bypass, in version 1.13.0
IBM lists two Langflow flaws rated 9.8, an authentication bypass and code execution, fixed in 1.13.0. No workaround; no exploitation reported as of Nov. 2.
IBM Security published a bulletin on October 28, 2026, modified on October 29, about Langflow OSS, the open source platform for building AI agent workflows. It lists two critical flaws, CVE-2026-93680 and CVE-2026-110186, both rated 9.8 out of 10 and both fixed in version 1.13.0. So there are two flaws at this score, not one. As of November 2, 2026, no exploitation of these CVEs has been reported. We tested nothing.
The essentials
- What is established: two flaws rated 9.8 (CVSS 3.1), reachable over the network without privilege or user interaction; affected versions 1.0.0 to 1.12.8 on Windows, Linux and macOS; fixed in 1.13.0.
- What IBM advises: upgrade to 1.13.0, after a backup. IBM offers no workaround.
- Exploitation: none reported as of November 2, and none in CISA's KEV catalog. That can change.
- A trap: if your deployment relied on automatic login, prepare an account with a password before upgrading.
What do the IBM bulletin and the CVE records say?
CVE-2026-93680 is an authentication that can be bypassed remotely (CWE-287). Its vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning reachable over the network, with no privilege and no user interaction. According to security press and Ostorlab, it is an incomplete fix of an automatic login ("auto-login") check that is active by default. In 1.13.0, automatic login is disabled by default.
CVE-2026-110186 allows arbitrary code execution through insufficient control of code generation (CWE-94). It is also rated 9.8, with the same vector. The bulletin describes a path without authentication through MCP (Model Context Protocol) tool enumeration. The press notes that the CVE descriptions do not explicitly tie this path to a specific identifier.
The bulletin lists two other Langflow flaws. CVE-2026-110193 (8.8): a low-privilege authenticated user can get the "Agentic Assistant" to generate code that runs operating system commands. CVE-2026-110192 (6.5): insufficiently protected credentials, for an authenticated user. It also lists three flaws in the Hono library (5.9, 5.3 and 6.5).
Source: IBM Security bulletin.
Who is affected, and under what conditions?
Any Langflow OSS instance from 1.0.0 to 1.12.8. According to Ostorlab, the risk conditions are an instance reachable by untrusted people, including on an internal network, and automatic login not explicitly disabled. Limiting network access to the interface and to the MCP endpoints reduces the risk but is not a fix (aicybr, Ostorlab).
What does 1.13.0 change, and how to upgrade without locking yourself out?
IBM's steps: run pip install --upgrade "langflow==1.13.0", or use the Docker image langflowai/langflow:1.13.0. Back up first: the database, the secret key and the uploaded files.
If the deployment used automatic login, prepare an account with a password before upgrading. According to GBHackers, hol.org and Ostorlab, a 1.12 instance upgraded in place may otherwise refuse to start ("Username and password must be set"). Ostorlab adds that setting LANGFLOW_AUTO_LOGIN=true again after the update reopens access. The fix does not revoke secrets that were already exposed (aicybr, hol.org): if the instance was reachable by untrusted third parties, rotate the keys.
Exploitation: where do things stand?
As of November 2, 2026, no exploitation of these CVEs has been reported and none appears in CISA's KEV catalog (Ostorlab, GBHackers, The Hacker News via neomanex). CISA's ADP entry for CVE-2026-110186 gives an SSVC assessment of exploitation "none", automatable "yes" and technical impact "total".
A public Metasploit module cites CVE-2026-93680. According to The Hacker News, it demonstrates the bypass, not code execution, and it targets versions 1.5.0 to 1.11.4, a narrower range than IBM's. A separate precedent, CVE-2025-3248 (also Langflow), was exploited and is in the KEV: do not confuse the two.
What is not established?
Source: IBM Security bulletin, CVE records and press, read in part via automatic summaries.
Whether these flaws will be exploited, since the "no exploitation" status dated November 2 can change. How many exposed instances really exist. Which identifier the MCP path belongs to. And anything we did not read: the GitHub release notes for 1.13.0 and NVD.
Comparison table
| CVE | Score | Impact | Authentication required |
|---|---|---|---|
| CVE-2026-93680 | 9.8 | Authentication bypass (CWE-287) | No |
| CVE-2026-110186 | 9.8 | Arbitrary code execution (CWE-94) | No, per the bulletin (MCP path) |
| CVE-2026-110193 | 8.8 | Code generated by the assistant runs OS commands | Yes, low-privilege user |
| CVE-2026-110192 | 6.5 | Insufficiently protected credentials | Yes |
Frequently asked questions
Which version should I move to?
1.13.0, the only fixed version according to IBM. There is no workaround.
Are these flaws being exploited?
None reported as of November 2, 2026, and none in CISA's KEV catalog. This is a snapshot, not a guarantee.
Could the upgrade lock me out?
Possibly, if the deployment used automatic login: prepare an account with a password first and back up your data.
Method and limits
We read the IBM bulletin and the CVE records (JSON) in full. Ostorlab, GBHackers, aicybr, neomanex (relaying The Hacker News) and hol.org, an aggregator, were read through automatic summaries. We did not read the original The Hacker News article (not found), the GitHub release notes for 1.13.0 or NVD. We tested nothing. This is not personalized security advice.
Sources
- IBM Security bulletin (October 28, 2026, modified October 29)
- CVE-2026-93680 record (CVE.org, cvelistV5)
- CVE-2026-110186 record (CVE.org, cvelistV5)
- Ostorlab, read via an automatic summary
- GBHackers, read via an automatic summary
- aicybr, read via an automatic summary
- neomanex (relaying The Hacker News), read via an automatic summary
Spotted an error in this article? Report it · Our corrections policy
