Langflow 1.13.0 fixes two unauthenticated 9.8 flaws in every 1.x release

Langflow 1.13.0 fixes two unauthenticated 9.8 flaws in every 1.x release

29 October 2026: Every Langflow OSS release from 1.0.0 to 1.12.8 carries two critical flaws that need no login, according to CVE records IBM published on 29 October: CVE-2026-93680, an authentication bypass, and CVE-2026-110186, which lets a remote attacker run arbitrary code "due to improper control of code generation". Both are rated 9.8. The only fix is Langflow 1.13.0 or later.

Not yet independently verified. IBM's bulletin did not load for us; the flaws, scores and fixed version come from IBM's own CVE records. We will update this when it can be confirmed, and remove this note.

Langflow is an open-source visual builder for AI agents and retrieval workflows, released under IBM's name. Flows hold the API keys for the models and data sources they call, so a takeover reaches beyond the server itself.

Four flaws, one upgrade

IBM's records list two more flaws with the same affected range and the same fix:

• CVE-2026-93680 (9.8): improper authentication lets a remote attacker bypass security restrictions.
• CVE-2026-110186 (9.8): improper control of code generation lets a remote attacker execute arbitrary code.
• CVE-2026-110193 (8.8): a low-privileged user can make the Agentic Assistant generate or submit component code that runs operating system commands on the server.
• CVE-2026-110192 (6.5): an authenticated attacker can obtain credentials that are not protected well enough.

The upgrade is "pip install langflow --upgrade" for Python installs, or the latest tagged image for Docker.

Why 1.12.8 is not enough

The release history is the trap. Langflow 1.12.8 was published at 17:08 UTC on 22 October and 1.13.0 at 21:20 UTC the same day, so a team that updated that afternoon to the newest 1.12 build is still exposed. IBM's records name 1.12.8 as the last affected version, and there is no fix on the 1.12 line.

The Hacker News reports that 1.13.0 also turns automatic login off by default, a setting that let anyone reaching the server act as a user without credentials. Its report adds that IBM offers no workaround and that a public Metasploit module already references CVE-2026-93680, although that module only lists tools exposed over MCP rather than running code.

Before and after the upgrade

The Hacker News also advises backing up the Langflow database, its secret key and uploaded files before upgrading. After upgrading, rotate the model and data-source keys held in flows on any server that was reachable from the internet, and check that automatic login is off. Neither flaw was in CISA's Known Exploited Vulnerabilities catalogue when we checked on 2 November.

Our catalogue lists 14 products in agentic AI software and 11 in low-code development platforms.

Sources

• IBM: CVE-2026-93680 record (CNA), 29 October 2026
• IBM: CVE-2026-110186 record (CNA), 29 October 2026
• IBM: security bulletin for Langflow OSS (node 7294467), 29 October 2026
• Langflow: v1.13.0 release, 22 October 2026
• The Hacker News: Critical Langflow flaws, 2 November 2026