Critical Langflow Vulnerabilities Enable Authentication Bypass and Remote Code Execution

Security researchers have disclosed multiple vulnerabilities in Langflow, an open-source platform for building AI agents and workflows, including two critical flaws that could allow unauthenticated attackers to bypass authentication or execute arbitrary code on vulnerable servers.

According to an IBM security bulletin published on October 28 and updated the following day, the vulnerabilities affect Langflow versions 1.0.0 through 1.12.8. The identified issues are addressed in Langflow 1.13.0, released on October 22, 2026.

The flaws are particularly concerning because they affect systems that may expose AI workflows and tools through network-accessible interfaces. One vulnerability involves unauthenticated remote code execution through Model Context Protocol (MCP) tool enumeration, potentially creating a path for attackers to interact with exposed Langflow services without valid credentials.

As of October 30, the two critical vulnerabilities were not listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog. However, six other Langflow vulnerabilities had already been added to the catalog, most recently CVE-2026-9198 in August.

Four Vulnerabilities Identified in IBM Security Bulletin

IBM's advisory describes four Langflow vulnerabilities with severity ratings ranging from medium to critical.

CVE IDCVSS ScoreAuthentication RequiredPotential ImpactCVE-2026-936809.8 CriticalNoAuthentication bypass and circumvention of security restrictionsCVE-2026-1101869.8 CriticalNoArbitrary code execution due to improper control of code generationCVE-2026-1101938.8 HighYes, low-privileged accountExecution of operating system commands through component code generated or submitted by the Agentic AssistantCVE-2026-1101926.5 MediumYesExposure of sensitive information due to insufficiently protected credentials

The two critical vulnerabilities are the most serious because they reportedly do not require an attacker to authenticate before exploitation. Depending on the affected deployment and its exposure, successful exploitation could undermine application security or compromise the server.

The other vulnerabilities involve the execution of operating system commands through the Agentic Assistant and the potential disclosure of sensitive credentials.

Authentication Bypass Exploit References MCP Endpoints

One of the vulnerabilities, CVE-2026-93680, involves an authentication bypass that can expose Langflow's Model Context Protocol functionality.

MCP allows compatible AI applications to interact with tools and workflows exposed by supporting services. Langflow can make its flows available as tools through MCP, allowing external AI applications to discover and use those capabilities.

A module in the public Metasploit Framework already references CVE-2026-93680. The module connects to a Langflow server's MCP endpoint without credentials, establishes a session, and enumerates the available tools.

The module's documented functionality does not include executing commands or running code on the target server. Nevertheless, unauthenticated access to an endpoint intended to expose application capabilities can represent a significant security concern.

The module author identifies Langflow versions 1.5.0 through 1.11.4 as affected, which is a narrower range than the 1.0.0 through 1.12.8 range reported by IBM.

This difference highlights the importance of consulting the vendor's security advisory rather than assuming that the versions covered by an individual proof-of-concept represent the complete scope of a vulnerability.

Automatic Login Configuration Raises Additional Concerns

Langflow's automatic login functionality is another important aspect of the authentication issues.

The LANGFLOW_AUTO_LOGIN setting is enabled by default in Langflow 1.12.8. When active, it automatically logs users in as superusers without requiring them to enter credentials.

The configuration's code documentation explicitly warns that this behavior bypasses authentication and should only be used in development environments.

The public Metasploit module was tested against Langflow 1.8.4 with automatic login enabled.

IBM also describes one of the vulnerabilities as an incomplete remediation of an automatic-login security control. However, its bulletin does not clarify whether systems with automatic login disabled remain vulnerable to the reported issues.

Organizations should therefore avoid treating the automatic-login setting as the only factor determining exposure and should apply the vendor's recommended upgrade.

Langflow 1.13.0 Addresses the Reported Vulnerabilities

Langflow 1.13.0 was released on October 22, 2026. Version 1.12.8, released on the same day, remains affected according to IBM's advisory.

The newer release also changes the automatic-login behavior, turning the feature off by default.

Upgrading to Langflow 1.13.0 is the recommended remediation for the four vulnerabilities described in IBM's bulletin. IBM does not provide a workaround for deployments that cannot upgrade immediately.

Before upgrading, administrators should take the following precautions:

1. Back up critical data: Preserve the database, secret key, uploaded files, and other deployment data.
2. Prepare user authentication: If automatic login is enabled, ensure that the existing account is configured for password-based sign-in by following Langflow's upgrade documentation.
3. Upgrade the deployment: For Python installations, run pip install --upgrade "langflow==1.13.0". For Docker deployments, move to the langflowai/langflow:1.13.0 image while preserving the deployment's persistent data.
4. Verify access after upgrading: If login fails, follow the documented account-recovery procedure instead of deleting or reinstalling the application.

Langflow warns that deleting or reinstalling an installation during recovery can permanently remove existing flows. Backups and careful migration procedures are therefore essential.

Additional Langflow Vulnerabilities Disclosed

IBM also published records for 29 additional Langflow vulnerabilities on October 29, bringing the total discussed across the disclosures to 33.

Among these issues is CVE-2026-104339, another vulnerability rated CVSS 9.8 that could reportedly allow unauthenticated arbitrary code execution.

IBM identified Langflow versions 1.12.4 and 1.12.5 as fixes for certain vulnerabilities in this additional group. However, none of the 33 records, including the four covered by the original bulletin, lists Langflow 1.13.0 as an affected version.

The broader set of disclosures reinforces the need for administrators to review the relevant advisories and keep Langflow deployments updated rather than relying on individual vulnerability fixes alone.

Security Implications for AI Workflow Deployments

Langflow is designed to simplify the development of AI agents and automated workflows. However, vulnerabilities in authentication, code generation, and tool exposure can create risks that extend beyond the application itself.

An exposed instance may provide access to workflows, credentials, integrations, or functionality that interacts with the underlying operating system. If an attacker achieves code execution, the potential consequences will depend on the permissions of the Langflow process, the deployment architecture, and the security controls surrounding the server.

Organizations running Langflow should upgrade to version 1.13.0, disable development-only authentication shortcuts, restrict access to administrative interfaces, and review network exposure for MCP endpoints.

Administrators should also verify that secrets are protected, operating system permissions are appropriately restricted, and application logs are reviewed for suspicious activity.

With multiple critical vulnerabilities reported across Langflow releases, timely patching and careful configuration are essential to reducing the risk of unauthorized access and server compromise.