Langflow 1.13.0 fixes unauthenticated code execution
Langflow 1.13.0 is the only available fix for two critical vulnerabilities that could allow remote attackers without accounts to bypass authentication or run arbitrary code on a server, according to IBM. Remote code execution means making another computer run attacker-chosen instructions. Every Langflow release from 1.0.0 through 1.12.8 is affected.
Langflow is an open-source application for creating artificial intelligence agents and workflows, and its vulnerability reports are handled by IBM. IBM's bulletin covers four vulnerabilities and was first published on October 28, then updated the following day. Two received a 9.8 Critical score under the Common Vulnerability Scoring System (CVSS), a standard scale for rating the severity of security flaws.
CVE-2026-93680 is an improper authentication flaw that IBM says could allow an attacker without an account to bypass security restrictions. Authentication is the process a system uses to confirm that a user is allowed to sign in. CVE-2026-110186, also rated 9.8, requires no account and could permit arbitrary code execution because Langflow does not adequately control code generation.
The other two flaws require access to an account. CVE-2026-110193 has an 8.8 High rating and could let a low-privileged user make the Agentic Assistant generate or submit component code that executes operating system commands on the server. CVE-2026-110192 is rated 6.5 Medium and could expose sensitive information because credentials, the information used to prove a user's identity, are not sufficiently protected.
IBM describes one of the problems as unauthenticated remote code execution through Model Context Protocol tool enumeration. Model Context Protocol (MCP) is a method through which Langflow can make its flows available as tools to compatible AI applications. Tool enumeration means asking the server for a list of the tools it offers. IBM's wording indicates that this process can be used to exploit the code execution weakness without first signing in.
A public module for the Metasploit Framework, a security testing platform containing reusable test modules, already references CVE-2026-93680. It connects without credentials to a Langflow server's MCP endpoint, the network address through which an application receives requests. The module starts a session and lists the tools available from the server, but it does not execute commands or code. Its author identifies versions 1.5.0 through 1.11.4 as affected, a narrower range than IBM's 1.0.0 through 1.12.8 assessment.
Automatic login is an important part of the issue. When enabled, Langflow signs users in as superusers, accounts with the highest level of control, without asking for normal sign-in details. The LANGFLOW_AUTO_LOGIN setting is enabled by default in Langflow 1.12.8, although its code description says it bypasses authentication and should be limited to development environments. The Metasploit module was tested against Langflow 1.8.4 with automatic login enabled.
IBM characterises another of the four vulnerabilities as an incomplete fix for an automatic-login security control. However, its bulletin does not establish whether deployments with automatic login disabled remain vulnerable. Administrators should therefore not treat switching off that setting as a substitute for installing the fixed release, especially because IBM provides no workaround for systems that cannot yet upgrade.
Langflow 1.13.0 was released on October 22 and changes automatic login so that it is disabled by default. Version 1.12.8 was released on the same day but still contains the flaws. As of November 2, the Python Package Index (PyPI), the online repository used to distribute Python software, listed no newer release in the 1.12 branch.
Before upgrading, administrators should back up the Langflow database, secret key and uploaded files. Deployments that currently use automatic login must prepare the existing account for password-based sign-in by following Langflow's upgrade guidance. Python package installations can be updated with pip install --upgrade "langflow==1.13.0", where pip is the tool used to install Python packages. Docker deployments should move to the langflowai/langflow:1.13.0 image while retaining their persistent data, meaning information kept when a software container is replaced.
If sign-in fails after the update, administrators should use the recovery procedure linked from the same upgrade guidance. Langflow's documentation warns against deleting or reinstalling the application simply to regain access, because doing so can permanently remove saved flows.
As of the October 30 update to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, neither critical flaw appeared in that list of security issues known to have been exploited. Six other Langflow flaws are listed, including CVE-2026-9198, which was added in August. Absence from that catalog does not change IBM's Critical severity ratings or the need to update.
IBM also published records on October 29 for 29 additional Langflow vulnerabilities, naming versions 1.12.4 and 1.12.5 as their fixes. One, CVE-2026-104339, is another 9.8-rated flaw that could let an unauthenticated attacker execute arbitrary code. None of the 33 records, including the four in the later bulletin, identifies Langflow 1.13.0 as affected.
For organisations assessing the security of systems that host applications such as Langflow, AEU-I provides security-first IT, infrastructure and consulting. The immediate action for affected Langflow deployments remains a careful, backed-up upgrade to version 1.13.0.