Critical Langflow vulnerabilities allow unauthenticated remote code execution

IBM has disclosed two critical security vulnerabilities in Langflow, an open-source platform for building AI agents and workflows. These flaws, present in every release from version 1.0.0 through 1.12.8, allow remote attackers to bypass authentication or execute arbitrary code on affected servers without needing an account. The only remediation is upgrading to version 1.13.0, which was released on October 22.

What happened

Langflow serves as a visual interface for constructing large language model applications, allowing developers to chain components into complex workflows. Because these workflows often handle sensitive data and connect to various external services, the platform’s security posture is critical for enterprise deployments. IBM, which handles vulnerability reports for the project, published a bulletin on October 28 detailing four specific flaws, two of which are rated critical with a CVSS score of 9.8.

The most severe issues involve improper authentication controls and insufficient regulation of code generation. Specifically, CVE-2026-93680 allows an attacker to bypass security restrictions entirely, while CVE-2026-110186 enables the execution of arbitrary code. Both vulnerabilities can be exploited by unauthenticated users, meaning no valid login credentials are required to initiate an attack. A third high-severity flaw, CVE-2026-110193, requires a low-privileged account but still permits the execution of operating system commands via the Agentic Assistant.

As of the October 30 update to CISA’s Known Exploited Vulnerabilities catalog, neither of these two critical flaws has been listed, though six other Langflow vulnerabilities are currently tracked there. However, the risk remains acute because a module for the Metasploit Framework already exists that exploits the authentication bypass vulnerability, CVE-2026-93680. This indicates that active exploitation tools are publicly available, increasing the likelihood of opportunistic attacks against unpatched instances.

How it works

The authentication bypass vulnerability stems from how Langflow handles the Model Context Protocol (MCP). MCP allows Langflow to expose its workflows as tools to other AI applications. IBM notes that one flaw involves "unauthenticated remote code execution exploitable through model context protocol tool enumeration." An attacker can connect to the Langflow server’s MCP endpoint without providing credentials, start a session, and enumerate the available tools. In configurations where automatic login is enabled, this access can escalate quickly.

Automatic login is controlled by the LANGFLOW_AUTO_LOGIN setting, which is enabled by default in version 1.12.8. When active, this setting logs users in as superusers without prompting for a password. The code documentation explicitly warns that this feature "bypasses authentication and should only be used in development environments." Despite this warning, its default status in recent releases exposes many production-like deployments to risk. The Metasploit module targeting this issue was tested on Langflow 1.8.4 with automatic login turned on, demonstrating how easily an attacker can gain privileged access.

The second critical flaw, CVE-2026-110186, relates to improper control of code generation. This vulnerability allows an attacker to inject and run arbitrary code on the server. IBM describes this as an incomplete remediation of a previous auto-login security control. It remains unclear from the bulletin whether servers with automatic login explicitly disabled are still vulnerable to this specific code execution path, but the broad scope of affected versions suggests a deep-seated issue in the core architecture rather than a simple configuration error.

Key details

• Affected versions: All Langflow releases from 1.0.0 through 1.12.8 are vulnerable.
• Fixed version: Only version 1.13.0, released on October 22, addresses these flaws.
• Critical CVEs: CVE-2026-93680 (authentication bypass) and CVE-2026-110186 (arbitrary code execution) both have a CVSS score of 9.8.
• Exploit availability: A Metasploit module exists for CVE-2026-93680, facilitating unauthenticated access to MCP endpoints.
• Default configuration risk: The LANGFLOW_AUTO_LOGIN setting is enabled by default in version 1.12.8, granting superuser privileges without authentication.
• No workarounds: IBM states there are no effective workarounds for servers that cannot be upgraded immediately.

Why it matters

For engineering teams using Langflow to prototype or deploy AI agents, these vulnerabilities represent a significant supply chain risk. The combination of unauthenticated access and arbitrary code execution means that any exposed Langflow instance could be fully compromised. Attackers could steal sensitive credentials, manipulate AI workflows, or use the server as a pivot point for further network intrusion. The fact that the exploit module is already public lowers the barrier to entry for less sophisticated threat actors, making rapid patching essential.

The default enablement of automatic login in recent versions highlights a common tension in developer tools between ease of use and security. While convenient for local development, shipping such settings in defaults for broader releases can lead to widespread exposure when developers forget to harden configurations before deployment. This incident underscores the need for rigorous security reviews of default settings in open-source AI infrastructure tools, especially those that manage code execution and agent behaviors.

What you can do

• Upgrade immediately: Update your Langflow installation to version 1.13.0 using pip or Docker.
• Back up data: Before upgrading, back up your database, secret key, and uploaded files to prevent data loss.
• Prepare for authentication changes: If you use automatic login, prepare existing accounts for password-based sign-in as described in Langflow’s upgrade guidance.
• Use correct Docker image: Switch to the langflowai/langflow:1.13.0 image while preserving persistent data volumes.
• Follow recovery steps: If you lose access after upgrading, use the official recovery steps instead of reinstalling, which can delete flows.
• Monitor for updates: Keep an eye on IBM’s security bulletins and CISA’s catalog for any new developments regarding these CVEs.