Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

Summary: IBM reported two critical Langflow flaws that let an unauthenticated remote attacker bypass authentication or run arbitrary code, affecting every release from 1.0.0 through 1.12.8, with the only fix in version 1.13.0. A public Metasploit module already cites CVE-2026-93680, the authentication bypass, and connects to a Langflow server's MCP endpoint without credentials to list its tools, while the setting LANGFLOW_AUTO_LOGIN is enabled by default in 1.12.8 and its code warns it "bypasses authentication and should only be used in development environments."
Key Takeaway: Langflow 1.13.0 shipped on October 22, yet 1.12.8 released the same day still carries the flaws, PyPI listed no later 1.12 release as of November 2, and IBM offers no workaround for servers that cannot upgrade yet.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-104339 CVE-2026-9198 CVE-2026-93680
Related: CVE-2026-9198: IBM Langflow Code Injection Vulnerability Known Exploited Vulnerabilities · Aug 04, 2026
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts Cyber Risks ·
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited Cyber Risks ·