Skip to content
Hacker Posts

Langflow 1.13.0 fixes two unauth 9.8 flaws; patch now

IBM's bulletin assigns four CVEs to Langflow OSS, two rated 9.8 (CVE-2026-93680 auth bypass, CVE-2026-110186 RCE). Everything through 1.12.8 is affected; fix is 1.13.0.

Published 3 min read
cvelangflowrceai-security

IBM has assigned four CVEs to Langflow OSS, the popular visual builder for LLM agents, two of them rated CVSS 9.8 and exploitable without an account. Every release from 1.0.0 through 1.12.8 is affected; the fix is 1.13.0, out since October 22. If you run a Langflow instance reachable from untrusted networks, treat this as a patch-today item.

The authoritative list is IBM's security bulletin, first published October 28. The Hacker News surfaced it today.

The CVEs

Per IBM:

  • CVE-2026-93680 — CVSS 9.8, improper authentication. A remote attacker bypasses security restrictions. No account needed.
  • CVE-2026-110186 — CVSS 9.8, improper control of code generation. Lets a remote attacker run arbitrary code. No account needed.
  • CVE-2026-110193 — CVSS 8.8, code injection. A low-privileged user coaxes the Agentic Assistant into producing component code that runs OS commands.
  • CVE-2026-110192 — CVSS 6.5, insufficiently protected credentials. A low-privileged user reads sensitive data.

The same bulletin pulls in three bundled Hono dependency flaws (CVE-2026-84363, -84364, -84365), fixed in Hono 4.13.5 and shipped inside 1.13.0.

Auto-login is the root of the exposure

Langflow's LANGFLOW_AUTO_LOGIN was on by default through 1.12.8 — a setting whose own description warns it "bypasses authentication and should only be used in development environments." Plenty of internet-facing deployments ran it anyway. The 1.13.0 release flips automatic login off by default and adds superuser-recovery guidance for operators upgrading from an auto-login install.

Exploitation status

None of the four is in CISA's KEV catalog as of the October 30 update. But a public Metasploit auxiliary module exists for CVE-2026-93680: it connects to the Model Context Protocol endpoint without credentials and enumerates tools. The module stops short of running code, but it confirms the unauthenticated reach, and the gap from "list tools" to "run tools" is narrow. Note that only IBM has rated these; NVD had not yet enriched them at the time of writing.

Action checklist

  1. Upgrade to Langflow 1.13.0 on every instance. It is the only release that fixes all four bulletin CVEs.
  2. If you can't upgrade today, turn off LANGFLOW_AUTO_LOGIN and put the instance behind authentication — IBM lists no other workaround.
  3. Get Langflow off the public internet. It's an agent-building tool, not an edge service; bind it to an internal network or VPN.
  4. Hunt for unauthenticated MCP tool enumeration in access logs if your instance was exposed on a vulnerable build.

Context

This is the latest in a steady run of Langflow RCEs — CVE-2025-34291 and the MCP stdio bug both reached our pages this year, and the 2025 flaw landed in KEV. The pattern is consistent: a tool built to generate and run code, shipped with authentication optional, exposed to the internet by users who treated a dev default as production-ready. The fix here isn't only the patch — it's that 1.13.0 finally makes the insecure default the exception.

Related stories