CybersecurityVulnerability Management

Langflow Flaws Expose Servers to Unauthenticated Code Execution

Analyst 207||Source: TheHackerNews
A well-lit lab bench with various instruments and a laptop at its center.

"Every release from 1.0.0 through 1.12.8 has the flaws," IBM reported — a concise, stark finding that frames the urgency for anyone running Langflow.

Scope and severity: two critical flaws across Langflow releases

IBM published a bulletin on October 28 (updated October 29) saying two critical vulnerabilities in the open‑source AI workflow tool Langflow could allow a remote, unauthenticated attacker to bypass authentication or execute arbitrary code. IBM said the flaws affect every Langflow release from 1.0.0 through 1.12.8 and that the only fix is Langflow 1.13.0. The bulletin enumerated four flaws in total; two of those are described by IBM as critical.

IBM additionally published CVE records on October 29 for 29 other Langflow flaws and named versions 1.12.4 and 1.12.5 as fixes for that set. One of those—CVE-2026-104339—was rated 9.8 by IBM and could also let an unauthenticated attacker run arbitrary code. IBM’s record set and the four new records do not list 1.13.0 as affected.

How attackers can probe: MCP exposure and a Metasploit module (CVE-2026-93680)

IBM said one flaw is an "unauthenticated remote code execution exploitable through model context protocol tool enumeration," referring to Langflow's Model Context Protocol (MCP) feature that can expose flows as tools to MCP‑capable AI apps. A public Metasploit Framework module already cites CVE-2026-93680 (the authentication bypass). According to the module's description, it connects to a Langflow server's MCP endpoint without credentials, starts a session, and lists the tools the server offers. The module's author notes the affected range as Langflow 1.5.0 through 1.11.4 — a narrower set than IBM’s statement.

IBM’s bulletin says the Metasploit module does not itself run code or commands on the server, but its existence underlines how straightforward discovery of exposed MCP endpoints could be for an attacker scanning for vulnerable instances.

Automatic login, an "incomplete remediation," and testing details

IBM called out an "incomplete remediation of an auto‑login security control" among the four issues. Langflow’s automatic login feature (LANGFLOW_AUTO_LOGIN) is enabled by default in Langflow 1.12.8; the code warns this setting "bypasses authentication and should only be used in development environments." The Metasploit module was tested on Langflow 1.8.4 with automatic login turned on.

IBM’s bulletin does not state whether servers with automatic login turned off are vulnerable to the authentication bypass, leaving a specific attack surface question open for defenders to resolve through testing and upgrades.

Upgrading to Langflow 1.13.0 — concrete steps and cautions

Langflow 1.13.0 was released on October 22 and, according to IBM, is the only release that fixes the newly reported critical flaws. Version 1.12.8, released the same day, still contains the issues, and PyPI listed no newer 1.12.x release as of November 2.

IBM and Langflow’s upgrade guidance list precise preparatory and recovery actions administrators must take:

  • Back up the database, the secret key and uploaded files before upgrading.
  • If the server used automatic login, prepare the existing account for password sign‑in as the upgrade guidance describes.
  • Upgrade the Python package with pip install --upgrade "langflow==1.13.0" or, for Docker deployments, move to the langflowai/langflow:1.13.0 image and retain persistent data.
  • If you cannot sign in after upgrading, follow the documented recovery steps; do not delete or reinstall Langflow to regain access, because Langflow documentation warns that doing so can permanently remove your flows.

What this means for technologists, procurement leaders, and defenders

Technologists and security teams: Verify whether you run Langflow versions up through 1.12.8 and whether LANGFLOW_AUTO_LOGIN was enabled. Back up databases, secret keys and uploaded files, and follow the upgrade steps to move to 1.13.0. Note that IBM offered no workaround for servers that cannot immediately upgrade.

Procurement and risk teams: The vulnerabilities were not in CISA's Known Exploited Vulnerabilities catalog as of the catalog's October 30 update, even though other Langflow CVEs (six) are listed there, most recently CVE-2026-9198 added in August. Track vendor advisories and the CISA catalog for changes that could affect contractual or escrow obligations.

Defenders and incident responders: A Metasploit module that enumerates MCP tools without credentials already exists. Even where that module does not execute code, it reduces the time and effort needed to discover exposed, vulnerable instances—raising the stakes for rapid inventory, patching and logging review.

Langflow 1.13.0 appears to remove the automatic‑login default and fix the reported issues, but IBM’s bulletin leaves some operational details unresolved — notably whether instances with automatic login disabled remain vulnerable to the authentication bypass. For administrators running Langflow, the immediate, concrete actions are clear: identify affected installations, back up critical data, and upgrade to 1.13.0 while following the project's recovery guidance carefully.

Original Hacker News report

Authentication BypassEmerging ThreatsSupply ChainOpen Source SecurityLangflowAI WorkflowUnauthenticated Code ExecutionCVE-2026-1234 Is Not Present However IBMMFA Bypass Is Not Mentioned But Code Execution And Auth Bypass Are So Code Execution And Auth Bypass Can Be Generalized As Remote Code Execution
Related Intelligence

Continue Reading

Empty network operations center with rows of equipment and cabling.

Armadin Tests Expose Widespread Security Gaps Beyond Vendor Advisories

Most critical security gaps remain invisible, with a staggering 88% of high-severity weaknesses only detectable through live testing, not vendor advisories or external sources. These hidden vulnerabilities lurk in organizations' own code, configurations, and repositories, leaving them exposed to severe threats.

Analyst 207
Windows Security app on a laptop with Smart App Control option grayed out.

Microsoft Resolves Smart App Control Issue Tied to October Windows Update

Microsoft has squashed a frustrating issue with Smart App Control that emerged after the October Windows update, and it's urging users to install the latest security update to get the fix. This update, released on October 28, 2026, and later, includes important improvements and resolutions to keep your device protected and running smoothly.

Analyst 207
Security analysts work at desks surrounded by screens in a bright, neutral-lit operations center.

SOCs Face AI Readiness Test Before Deployment

Are you ready to supercharge your Security Operations Center (SOC) with AI, or will it just add to the noise? To reap the benefits, your team needs to pass the AI readiness test and understand where AI can have the greatest impact, particularly for those handling high volumes of alerts or relying on MDR/MSSP services.

Analyst 207
Remote access gateway device in a clean-room setting, centered and sharply detailed.

Ivanti Disrupts Zero-Day Attacks with Patches for Two More Connect Secure Flaws

Ivanti has released emergency patches for two new zero-day flaws in its Connect Secure remote access gateways, which attackers have been exploiting since October to gain unauthorized access. These critical updates fix high-severity vulnerabilities that were being used in conjunction with a previously patched authentication bypass flaw.

Analyst 207