Critical Langflow Vulnerabilities Allow Authentication Bypass And Remote Code Execution

Two critical Langflow vulnerabilities could allow remote attackers to bypass authentication controls and execute arbitrary code on affected servers without requiring an account. The security issues were disclosed by IBM in a security bulletin published on October 28, 2026, and updated the following day.

Langflow is an open-source platform used by developers to build AI applications, agents and automated workflows through a visual interface. Since these environments can connect to external tools, APIs and sensitive information, security weaknesses could expose important application resources and server infrastructure.

According to IBM, Langflow versions ranging from 1.0.0 through 1.12.8 are affected. The company recommends upgrading to version 1.13.0, which addresses the reported vulnerabilities.

Four Security Vulnerabilities Identified

IBM’s security bulletin identifies four vulnerabilities affecting Langflow OSS. Two are rated critical, while the remaining issues carry high and medium severity ratings.

The vulnerabilities are:

CVE ID	CVSS Score	Authentication Required	Potential Impact
CVE-2026-93680	9.8 Critical	No	Authentication bypass and unauthorized access
CVE-2026-110186	9.8 Critical	No	Remote arbitrary code execution
CVE-2026-110193	8.8 High	Yes	Operating system command execution through generated component code
CVE-2026-110192	6.5 Medium	Yes	Exposure of sensitive credentials

The most serious concerns involve CVE-2026-93680 and CVE-2026-110186 because they can be exploited remotely without requiring valid user credentials.

Authentication Bypass and Remote Code Execution Risks

CVE-2026-93680 is an authentication-related vulnerability that could allow an attacker to bypass security restrictions and access functionality without proper authorization.

The issue is particularly relevant to Langflow’s Model Context Protocol (MCP) integration. MCP allows AI applications to interact with external tools and services, while Langflow can expose its workflows as tools through an MCP endpoint.

A publicly available module in the Metasploit Framework references this vulnerability. The module can connect to a vulnerable Langflow MCP endpoint without credentials, establish a session and enumerate the tools exposed by the server.

However, the module’s documented functionality focuses on authentication bypass and tool enumeration; it does not itself execute commands or run arbitrary code on the server.

The second critical issue, CVE-2026-110186, is more severe from a server security perspective. IBM reports that improper control of code generation could allow a remote attacker to execute arbitrary code without authentication.

Six Earlier Langflow Vulnerabilities Already Listed by CISA

The latest vulnerabilities add to a growing list of security concerns involving Langflow.

According to the reported update, six other Langflow vulnerabilities were already included in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog. The most recently added issue was CVE-2026-9198, which appeared in August 2026.

However, the four vulnerabilities covered in IBM’s October bulletin were not listed in the KEV catalog as of its update.

The absence of these vulnerabilities from the catalog should not be treated as confirmation that affected systems are safe. Organizations should still prioritize remediation based on the severity and exposure of their deployments.