Langflow Patches Two 9.8 Flaws, One an Auth Bypass

Two critical vulnerabilities in Langflow, an open-source framework for building AI agents and LLM-powered workflows, carry a 9.8 CVSS score, and IBM has released patches in version 1.13.0. The flaws affect every Langflow OSS release from 1.0.0 through 1.12.8, a version range that covers a wide swath of enterprise deployments.

Langflow's popularity comes from its visual, code-free approach to constructing AI workflows and retrieval-augmented generation systems. That combination—broad enterprise adoption and a graphical interface that lowers the barrier to entry—makes the exposed surface area substantial. The framework is now owned by IBM, which published the advisory alongside the fixes.

Auth Bypass With a Paper Trail

The first critical flaw, CVE-2026-93680, traces back to an earlier auto-login issue that was never fully remediated. An incomplete fix left a path open for attackers to bypass security restrictions and reach features that should require authentication. The fact that this is a follow-up to a prior patch means the underlying logic around automatic login remained exploitable even after the first attempt at correcting it.

Auto-login features are convenient for development and single-user setups, but in shared or internet-facing deployments they create a shortcut that bypasses normal credential checks. IBM's patch notes indicate the company has now closed the gap, but the sequence of events—fix, incomplete fix, new CVE—suggests the auto-login path warranted closer scrutiny than it initially received.

Because the flaw enables unauthenticated access to privileged functionality, it effectively hands an attacker a foothold without needing a username or password. From there, the other vulnerabilities in the same release become far easier to chain.

MCP Enumeration Opens a Code Execution Path

The second critical bug, CVE-2026-110186, allows unauthenticated remote attackers to execute arbitrary code through Model Context Protocol tool enumeration. MCP is the mechanism Langflow uses to connect agents to external tools and services; enumerating those tools without authentication is not supposed to expose an executable surface, but in affected versions it does.

This is the more dangerous of the two critical issues in practical terms. An unauthenticated RCE in a framework that is often deployed with access to API keys, internal services, and model endpoints gives an attacker direct server-side execution. The advisory lists it alongside CVE-2026-93680 as the pair rated 9.8.

Third-Party Library Behind the High-Severity Bug

The third vulnerability, CVE-2026-110193, is rated high severity and also permits code and command execution on the server. The root cause is an issue in a third-party library used by the Agentic Assistant component. Unlike the unauthenticated critical bugs, this one requires an attacker to authenticate first, even if only with a low-privileged account.

That authentication barrier reduces the immediate risk from anonymous attackers, but it does not eliminate it. In environments where user registration is open or where low-privilege accounts are shared, the distinction between authenticated and unauthenticated exploitation narrows considerably.

Credential Leakage in the Fourth Flaw

The fourth issue, CVE-2026-110192, is an information disclosure bug caused by insufficiently protected API credentials. It carries a 6.5 CVSS score. Leaked API credentials are a familiar problem for Langflow: the framework's vulnerabilities have been exploited in the wild before to steal AI and developer credentials, most recently in August.

For teams running Langflow, the credential angle may be the most operationally significant. API keys for model providers and internal services are often the most valuable asset in an AI deployment, and a flaw that exposes them does not require code execution to cause damage.

Upgrade Path and Backup Warning

IBM's fix is Langflow 1.13.0, available from the PyPI repository and as a Docker image. The company's advisory includes a caution for anyone upgrading: back up the database, secret key, and uploaded files before proceeding. Deployments that use automatic login need additional preparation, specifically making the existing account ready for password sign-in as described in the installation and Docker upgrade instructions.

The upgrade guidance matters because the auto-login remediation may change how existing accounts authenticate. Skipping the preparation step could lock users out of a working deployment or leave the old auto-login behavior in place.

“Before upgrading, back up the database, secret key, and uploaded files,” IBM said in its advisory. “If the deployment uses automatic login, prepare the existing account for password sign-in as described in the installation and Docker upgrade instruction.”

— IBM, in its security advisory for Langflow 1.13.0

Hono Patches Alongside Langflow

IBM also released patches for three medium-severity flaws in Hono, an API and web application development framework used inside Langflow for request routing and backend web server tasks. The company advises users to upgrade Hono to version 4.13.5.

Hono's role as the request-routing layer means its vulnerabilities sit directly in the path of incoming traffic. Even at medium severity, flaws in that layer deserve attention during the same upgrade cycle, particularly because they are bundled with fixes for the more severe Langflow issues.

What the Numbers Show

• 9.8 CVSS score for CVE-2026-93680 (authentication bypass)
• 9.8 CVSS score for CVE-2026-110186 (unauthenticated RCE via MCP tool enumeration)
• 6.5 CVSS score for CVE-2026-110192 (API credential disclosure)
• Four total vulnerabilities patched in Langflow 1.13.0
• 1.0.0 to 1.12.8 — affected Langflow OSS version range
• 1.13.0 — fixed version, available via PyPI and Docker
• 4.13.5 — required Hono version for three medium-severity fixes

Why This Matters for Langflow Users

The combination of an authentication bypass and an unauthenticated remote code execution path in the same release is about as direct a threat as a framework can carry. For organizations running Langflow in enterprise environments—particularly those where the visual interface has encouraged adoption outside traditional security review—the upgrade to 1.13.0 should be treated as urgent rather than routine.

The prior exploitation of Langflow flaws to steal AI and developer credentials, which have been exploited in the wild before, suggests that attackers are already watching this framework. The new critical bugs could give them another route to the same valuable targets. Teams that delay patching may find that the credentials and model access they rely on are the first things taken.

There is also a lesson in the incomplete remediation behind CVE-2026-93680. When a security fix is partial, the original vulnerability does not disappear—it evolves into a new CVE. Organizations that track only the first advisory may have believed they were covered when they were not. Verifying the version against the full affected range, and confirming that the auto-login path is actually disabled after upgrade, is part of closing this one properly.