Langflow patches two critical 9.8 flaws that let attackers run code without logging in

What IBM disclosed

IBM has published a security bulletin stating that Langflow OSS is affected by multiple vulnerabilities. Langflow is an open-source visual builder for AI agents, LLM workflows and retrieval-augmented generation pipelines, and IBM became its steward when it acquired DataStax in 2025. The bulletin is first dated 28 October 2026; security outlets including CSO Online and The Hacker News reported it on 3 November.

Two of the flaws are rated critical with a CVSS base score of 9.8. CVE-2026-93680 is an authentication bypass that, according to the bulletin and the coverage, stems from an incomplete fix for an earlier auto-login issue, so an attacker without an account can obtain access to the instance. CVE-2026-110186 is classed as code injection (CWE-94) and, according to the reporting, allows remote attackers to execute arbitrary code through Model Context Protocol tool enumeration. Combined, the two give an unauthenticated attacker a path to running code on the Langflow server.

Both affect Langflow OSS from version 1.0.0 through 1.12.8. IBM's remediation is to upgrade to Langflow 1.13.0, for example with the pip package langflow==1.13.0, and the bulletin offers no workaround for servers that cannot be upgraded yet. The bulletin also covers other, lower-rated issues; outlets disagree on how many, so the total is not given here.

Why Langflow servers are an attractive target

A Langflow instance usually holds what an attacker wants from an AI deployment: API keys for model providers, credentials for vector databases and cloud services, and the flows that connect them. Code execution on that server can therefore expose far more than the server itself. Because Langflow is often run by data and AI teams outside the usual application security process, instances can end up reachable from the internet with default settings.

Langflow has been exploited before. In 2025, CISA added the earlier code execution flaw CVE-2025-3248 to its Known Exploited Vulnerabilities catalog, and in March 2026 the Cloud Security Alliance reported that another unauthenticated flaw, CVE-2026-33017, came under active exploitation within about 20 hours of disclosure, with attackers harvesting model provider keys, cloud credentials and database connection strings. The bulletin does not say whether the two new flaws are being exploited, and one security outlet reports they were not in CISA's catalog as of its update.

The MCP angle is part of a wider pattern. As agent builders add MCP clients and servers, the code that discovers and calls tools becomes new attack surface, a theme also seen in the Wiz analysis of AI platform breaches and the malicious Cursor marketplace extension covered here last week.

What administrators should do

Teams running Langflow should upgrade every instance to 1.13.0, including development and test servers, and check whether any instance has been reachable from the internet while on an affected version. If so, IBM's lack of a workaround means the safest assumption is that stored secrets may be exposed: rotate model provider keys, database credentials and cloud tokens held in flows or environment variables, and review logs for unexpected logins or new flows. Placing Langflow behind an authenticating proxy or VPN reduces exposure to the next flaw. More coverage is in the cybersecurity section.

Finding every instance is often the hardest part. Langflow is installed as a Python package, through container images and inside larger platforms, so a version check needs to cover developer laptops and notebooks as well as shared servers; running pip show langflow in each environment, or reading the version in the application's settings, confirms whether it is below 1.13.0. Security teams can also search external attack surface tools and cloud inventories for the default Langflow port and page title. Because the second flaw is reached through MCP tool enumeration, instances that act as MCP servers for other agents deserve priority, since a compromise there can spread to the tools and data those agents use.

The open questions are who reported the two flaws, when exactly version 1.13.0 shipped relative to the bulletin, and whether exploit code will appear as quickly as it did for CVE-2026-33017 in March. Given that history, administrators should treat the patch window in days rather than weeks.

Questions people ask

Which Langflow versions are affected?

Langflow OSS 1.0.0 through 1.12.8, according to IBM's bulletin. Version 1.13.0 contains the fix.

Is there a workaround if I cannot upgrade Langflow?

IBM's bulletin lists none. Restricting network access to the instance reduces exposure, but upgrading to 1.13.0 is the remediation.

Are the Langflow flaws exploited in the wild?

The bulletin does not say. Earlier Langflow flaws, CVE-2025-3248 and CVE-2026-33017, were exploited after disclosure.

Sources

1. Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (IBM, 28 Oct 2026)
2. Critical Langflow flaws enable authentication bypass and RCE (CSO Online, 3 Nov 2026)
3. Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers (The Hacker News, 3 Nov 2026)
4. Research note: Langflow CVE-2026-33017 active exploitation (Cloud Security Alliance, 23 Mar 2026)